cloudformation.yml

AWSTemplateFormatVersion: "2010-09-09"

Description: CloudFront for static website

Parameters:
  DomainName:
    Description: User-facing DNS records
    Type: String
  CertificateArn:
    Description: ARN of ACM certificate in us-east-1
    Type: String
  OaiId:
    Description: ID of pre-created Origin Access Identity
    Type: String
    AllowedPattern: '[A-Z1-9]{14}'

Resources:
  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref DomainName

  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref 'S3Bucket'
      PolicyDocument:
        Statement:
        - Sid: !Sub "${AWS::StackName}-oai-allow"
          Action: s3:GetObject
          Effect: Allow
          Principal:
            AWS: !Sub "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${OaiId}"
          Resource: !Sub
            - "${BucketArn}/*"
            - { "BucketArn": !GetAtt S3Bucket.Arn }

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - DomainName: !GetAtt S3Bucket.DomainName
            Id: S3BucketOrigin
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${OaiId}"
        Comment: !Ref DomainName
        Aliases:
          - !Ref DomainName
        IPV6Enabled: true
        DefaultRootObject: 'index.html'
        DefaultCacheBehavior:
          TargetOriginId: S3BucketOrigin
          Compress: true
          AllowedMethods:
            - HEAD
            - GET
          ForwardedValues:
            QueryString: false
          ViewerProtocolPolicy: redirect-to-https
          LambdaFunctionAssociations:
            - EventType: origin-request
              LambdaFunctionARN: !Ref TheOriginRequestLambdaFunctionVersionV2
        PriceClass: PriceClass_All
        ViewerCertificate:
          AcmCertificateArn: !Ref CertificateArn
          SslSupportMethod: sni-only
        HttpVersion: http2
        CustomErrorResponses:
          - ErrorCode: 404
            ResponsePagePath: '/404.html'
            ResponseCode: 404
          - ErrorCode: 403
            ResponsePagePath: '/404.html'
            ResponseCode: 404

# combination of https://github.com/CloudUnder/lambda-edge-nice-urls and https://github.com/lroguet/amzn-cloudformation/blob/master/storage-content-delivery/static-website-with-cloudfront-lambda-edge.yml
  TheOriginRequestLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: >
        Lambda function performing request URI rewriting.
      Code:
        ZipFile: !Sub |
          /* Public domain project by Cloud Under (https://cloudunder.io).
           * Repository: https://github.com/CloudUnder/lambda-edge-nice-urls
           */

          const config = {
            suffix: '.html',
            appendToDirs: 'index.html',
            removeTrailingSlash: false,
          };

          const regexSuffixless = /\/[^/.]+$/; // e.g. "/some/page" but not "/", "/some/" or "/some.jpg"
          const regexTrailingSlash = /.+\/$/; // e.g. "/some/" or "/some/page/" but not root "/"

          exports.handler = function handler(event, context, callback) {
            const { request } = event.Records[0].cf;
            const { uri } = request;
            const { suffix, appendToDirs, removeTrailingSlash } = config;

            // Append ".html" to origin request
            if (suffix && uri.match(regexSuffixless)) {
              request.uri = uri + suffix;
              callback(null, request);
              return;
            }

            // Append "index.html" to origin request
            if (appendToDirs && uri.match(regexTrailingSlash)) {
              request.uri = uri + appendToDirs;
              callback(null, request);
              return;
            }

            // Redirect (301) non-root requests ending in "/" to URI without trailing slash
            if (removeTrailingSlash && uri.match(/.+\/$/)) {
              const response = {
                // body: '',
                // bodyEncoding: 'text',
                headers: {
                  'location': [{
                    key: 'Location',
                    value: uri.slice(0, -1)
                   }]
                },
                status: '301',
                statusDescription: 'Moved Permanently'
              };
              callback(null, response);
              return;
            }

            // If nothing matches, return request unchanged
            callback(null, request);
          };
      Handler: index.handler
      MemorySize: 128
      Role: !Sub ${TheOriginRequestLambdaFunctionExecutionRole.Arn}
      Runtime: nodejs6.10

  TheOriginRequestLambdaFunctionVersionV2:
    Type: AWS::Lambda::Version
    Properties:
      FunctionName: !Ref TheOriginRequestLambdaFunction
      Description: !Sub "URL rewriting for ${DomainName}"

  TheOriginRequestLambdaFunctionExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - edgelambda.amazonaws.com
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

Outputs:
  CloudFrontDistributionId:
    Description: CloudFront ID
    Value: !Ref CloudFrontDistribution
  CloudFrontDistributionDomainName:
    Description: CloudFront Domain Name
    Value: !GetAtt CloudFrontDistribution.DomainName
  URL:
    Description: User-facing URL
    Value: !Sub "https://${DomainName}"