gatsbyTemplate.yaml

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31
Resources:
  gatsbyBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${AWS::StackName}-gatsbybuc-${AWS::AccountId}
      WebsiteConfiguration:
        IndexDocument: index.html
  gatsbyBuild:
    Type: AWS::CodeBuild::Project
    Metadata:
      StackeryType: website
    DependsOn: gatsbyBuildRole
    Properties:
      Name: !Sub ${AWS::StackName}-gatsbyBuild
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/amazonlinux2-x86_64-standard:3.0
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: GHOST_API_URL
            Value: !Ref EnvConfigghostApiUrlAsString
          - Name: GHOST_CONTENT_API_KEY
            Value: !Ref EnvConfigghostContentApiKeyAsString
          - Name: SITEURL
            Value: !GetAtt gatsbyCDN.DomainName
          - Name: NODE_ENV
            Value: 'production'
      ServiceRole: !GetAtt gatsbyBuildRole.Arn
      Source:
        Type: NO_SOURCE
        BuildSpec: !Sub
          - |-
            version: 0.2
            phases:
              install:
                runtime-versions:
                  nodejs: latest
                  python: latest
                  ruby: latest
                commands:
                  - |
                    _SOURCE_LOCATION="${SourceLocation}"
                    if [ s3 != "${!_SOURCE_LOCATION%%:*}" ]; then
                      git clone "${SourceLocation}" repo
                      cd repo
                      git checkout "${SourceVersion}"
                    else
                      aws s3 cp "${SourceLocation}" repo.tgz
                      tar --strip-components 1 -xvvzf repo.tgz
                    fi
                  - cd ${SourceDirectory}
              pre_build:
                commands:
                  - |
                    if [ ! -f yarn.lock -a -f package.json ]; then
                      npm install --production
                    elif [ -f yarn.lock -a -f package.json ]; then
                      yarn install --production
                    elif [ -f requirements.txt ]; then
                      pip install -r requirements.txt
                    elif [ -f Gemfile ]; then
                      bundle install
                    fi
              build:
                commands:
                  - ${BuildCommand}
              post_build:
                commands:
                  - if [ $CODEBUILD_BUILD_SUCCEEDING == 0 ]; then exit 1; fi
                  - |
                    _SOURCE_LOCATION=${SourceLocation}
                    if [ s3 != "${!_SOURCE_LOCATION%%:*}" ]; then
                      cd "${!CODEBUILD_SRC_DIR}/repo"
                    else
                      cd "${!CODEBUILD_SRC_DIR}"
                    fi
                  - aws s3 sync '${PublishDirectory}' 's3://${DestinationBucketName}' --acl public-read --cache-control 'max-age=0, must-revalidate, public' --no-progress --delete
          - PublishDirectory: public
            BuildCommand: npm install && npm run build
            SourceDirectory: src
            DestinationBucketName: !Ref gatsbyBucket
      Tags:
        - Key: Stackery Project Type
          Value: Website Builder
  gatsbyBuildEvents:
    Type: AWS::Events::Rule
    DependsOn: gatsbyBuild
    Properties:
      EventPattern:
        source:
          - aws.codebuild
        detail-type:
          - CodeBuild Build State Change
        detail:
          build-status:
            - SUCCEEDED
            - FAILED
            - FAULT
            - STOPPPED
            - TIMED_OUT
          project-name:
            - !Ref gatsbyBuild
      Targets:
        - Arn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:stackery-agent-commander
          Id: StackeryAgentCommander
  gatsbyBuildEventsPermission:
    Type: AWS::Lambda::Permission
    DependsOn: gatsbyBuildEvents
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:stackery-agent-commander
      Principal: events.amazonaws.com
      SourceArn: !GetAtt gatsbyBuildEvents.Arn
  gatsbyBuildBuildTrigger:
    Type: Custom::StackeryWebsiteBuildTrigger
    DependsOn: gatsbyBuildEvents
    Properties:
      ServiceToken: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:stackery-agent-commander
      Type: website
      ProjectName: !Ref gatsbyBuild
      SourceVersion: !Ref SourceVersion
  gatsbyBuildRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-gatsbyBuild
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          Effect: Allow
          Principal:
            Service: codebuild.amazonaws.com
          Action: sts:AssumeRole
      Policies:
        - PolicyName: Logs
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${AWS::StackName}-gatsbyBuild:log-stream:*
        - PolicyName: DownloadSourceFromStackeryAssetsBucket
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: s3:GetObject
                Resource: arn:aws:s3:::stackery-assetsbucket-*/*
        - PolicyName: UploadToDestinationObjectStore
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:DeleteObject
                  - s3:GetBucketLocation
                  - s3:GetObject
                  - s3:ListBucket
                  - s3:PutObject
                  - s3:PutObjectAcl
                Resource:
                  - !Sub ${gatsbyBucket.Arn}/*
                  - !Sub ${gatsbyBucket.Arn}
  gatsbyCDN:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        DefaultCacheBehavior:
          CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6
          Compress: true
          # ForwardedValues:
          #   Cookies:
          #     Forward: none
          #   QueryString: false
          TargetOriginId: StackeryCDN
          ViewerProtocolPolicy: redirect-to-https
          LambdaFunctionAssociations:
            - EventType: origin-response
              LambdaFunctionARN: !GetAtt securedHeaders.VersionArn
        Enabled: true
        DefaultRootObject: index.html
        PriceClass: PriceClass_100
        Origins:
          - DomainName: !GetAtt gatsbyBucket.DomainName
            Id: StackeryCDN
            S3OriginConfig:
              OriginAccessIdentity: !Sub
                - origin-access-identity/cloudfront/${OriginAccessIdentity}
                - OriginAccessIdentity: !Ref gatsbyCDNOriginAccessIdentity
  gatsbyCDNOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: Stackery
  gatsbyCDNBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref gatsbyBucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${gatsbyCDNOriginAccessIdentity}
            Action: s3:GetObject
            Resource: !Sub
              - ${BucketArn}/*
              - BucketArn: !GetAtt gatsbyBucket.Arn
  securedHeaders:
    Type: Custom::StackeryEdgeFunction
    Properties:
      ServiceToken: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:stackery-agent-commander
      FunctionName: !Sub ${AWS::StackName}-securedHeaders
      Description: !Sub
        - Stack ${StackTagName} Environment ${EnvironmentTagName} Function ${ResourceName}
        - ResourceName: securedHeaders
      CodeUri: src/secured-headers
      Handler: index.handler
      Runtime: nodejs12.x
      MemorySize: 128
      Timeout: 5
      Tracing: Active
      Role: !GetAtt securedHeadersRole.Arn
  securedHeadersRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-securedHeaders
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          Effect: Allow
          Principal:
            Service:
              - lambda.amazonaws.com
              - edgelambda.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess
Parameters:
  SourceLocation:
    Type: String
    Description: Location of source code for deployment (injected by Stackery at deployment time)
  SourceVersion:
    Type: String
    Description: Source version for deployment (injected by Stackery at deployment time)
  EnvConfigghostApiUrlAsString:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /<EnvironmentName>/ghostApiUrl
  EnvConfigghostContentApiKeyAsString:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /<EnvironmentName>/ghostContentApiKey
  StackTagName:
    Type: String
    Description: Stack Name (injected by Stackery at deployment time)
  EnvironmentTagName:
    Type: String
    Description: Environment Name (injected by Stackery at deployment time)
Metadata:
  EnvConfigParameters:
    EnvConfigghostApiUrlAsString: ghostApiUrl
    EnvConfigghostContentApiKeyAsString: ghostContentApiKey