template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: >
  reserve-rec-admin

  SAM Template for Angular Admin Frontend

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 3
    MemorySize: 128

Parameters:
  Env:
    Type: String
    Description: Staging environment.
  AWSRegion:
    Type: String
    Default: ca-central-1
    Description: AWS Region.
  DistOriginPath:
    Type: String
    Default: latest
    Description: Cloudfront distribution origin path.
  ApiGatewayId:
    Type: String
    Description: ID for rest API.
  ApiStage:
    Type: String
    Default: api
    Description: API stage.
  # EnvDomainName:
  #   Type: String
  #   Default: dev-data.bcparks.ca
  DomainCertificateArn:
    Type: String
    Default: arn:aws:acm:us-east-1:970582042516:certificate/ef1d2666-8278-4d20-bdff-e27b55b3246f
  ApiCachePolicyId:
    Type: String
    Description: API cache policy ID.

Resources:
  CloudFrontOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: CloudFront access identity

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Restrictions:
          GeoRestriction:
            RestrictionType: blacklist
            # Belarus, Central African Republic, China, Democratic Republic of the Congo, Iran, Iraq, Democratic People's Republic of Korea, Lebanon, Libya, Mali, Myanmar, Nicaragua, Russia, Somalia, South Sudan, Sudan, Syria, Ukraine, Venezuela, Yemen, Zimbabwe
            Locations: [BY, CF, CN, CD, IR, IQ, KP, LB, LY, ML, MM, NI, RU, SO, SS, SD, SY, UA, VE, YE, ZW]
        PriceClass: PriceClass_100
        CustomErrorResponses:
          - ErrorCode: 404
            ResponseCode: 200
            ResponsePagePath: !Sub /index.html
          - ErrorCode: 403
            ResponseCode: 200
            ResponsePagePath: !Sub /index.html
        # Aliases:
        #   - !Ref EnvDomainName
        # ViewerCertificate:
        #   AcmCertificateArn: !Ref DomainCertificateArn
        #   SslSupportMethod: sni-only
        #   MinimumProtocolVersion: TLSv1
        Comment: !Sub "CloudFront distribution for ${AWS::StackName}"
        DefaultRootObject: !Sub index.html
        Enabled: true
        HttpVersion: http2
        # List of origins that Cloudfront will connect to
        Origins:
          - Id: !Ref DistS3Bucket
            DomainName: !GetAtt DistS3Bucket.RegionalDomainName
            S3OriginConfig:
              # Restricting Bucket access through an origin access identity
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}"
            OriginPath: !Sub /${DistOriginPath}/${AWS::StackName}/browser
          - Id: !Sub ${ApiGatewayId}
            DomainName: !Sub "${ApiGatewayId}.execute-api.${AWSRegion}.amazonaws.com"
            CustomOriginConfig:
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
              OriginSSLProtocols:
                - TLSv1.2
        # To connect the CDN to the origins you need to specify behaviours
        DefaultCacheBehavior:
          # Compress resources automatically ( gzip )
          Compress: true
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          # CachingDisabled
          CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad
          TargetOriginId: !Ref DistS3Bucket
          ViewerProtocolPolicy: redirect-to-https
          # Simple CORS
          ResponseHeadersPolicyId: 60669652-455b-4ae9-85a4-c4c02393f86c
        CacheBehaviors:
          - PathPattern: !Sub /${ApiStage}/*
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
              - PUT
              - POST
              - PATCH
              - DELETE
            # CachingDisabled
            CachePolicyId: !Ref ApiCachePolicyId
            TargetOriginId: !Sub ${ApiGatewayId}
            ViewerProtocolPolicy: redirect-to-https
            # Simple CORS
            ResponseHeadersPolicyId: 60669652-455b-4ae9-85a4-c4c02393f86c
          - PathPattern: /*
            Compress: true
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
            # CachingDisabled
            CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad
            TargetOriginId: !Ref DistS3Bucket
            ViewerProtocolPolicy: redirect-to-https
            # Simple CORS
            ResponseHeadersPolicyId: 60669652-455b-4ae9-85a4-c4c02393f86c
        Logging:
          Bucket: !GetAtt LogsS3Bucket.DomainName
          IncludeCookies: false
          Prefix: !Sub ${AWS::StackName}-${Env}-logs

  DistS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${AWS::StackName}-${Env}

  DistS3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref DistS3Bucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${CloudFrontOriginAccessIdentity}
            Action: "s3:GetObject"
            Resource: !Sub "arn:aws:s3:::${DistS3Bucket}/*"

  LogsS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${AWS::StackName}-${Env}-logs
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerPreferred

  LogsS3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref LogsS3Bucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${CloudFrontOriginAccessIdentity}
            Action: "s3:GetObject"
            Resource: !Sub "arn:aws:s3:::${LogsS3Bucket}/*"

Outputs:
  # ServerlessRestApi is an implicit API created out of Events key under Serverless::Function
  # Find out more about other implicit resources you can reference within SAM
  # https://github.com/awslabs/serverless-application-model/blob/master/docs/internals/generated_resources.rst#api
  Website:
    Value: !GetAtt CloudFrontDistribution.DomainName