website.yml

Description: Deploy a static website fronted by a CloudFront Distribution with an SSL certificate
Parameters:
  DomainName:
    Description: Domain name
    Type: String
  HostedZoneId:
    Description: Hosted Zone ID
    Type: String
  PriceClass:
    Type: String
    Description: The CloudFront distribution price class
    AllowedValues:
      - 'PriceClass_100'
      - 'PriceClass_200'
      - 'PriceClass_All'
Resources:
  S3Bucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: false
      OwnershipControls:
        Rules:
          - ObjectOwnership: ObjectWriter
      BucketName: !Sub "www.${DomainName}"
      WebsiteConfiguration:
        IndexDocument: "home.html"
        ErrorDocument: "home.html"
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - 'Authorization'
              - 'Content-Length'
            AllowedMethods:
              - GET
            AllowedOrigins:
              - '*'
            ExposedHeaders:
              - ETag
              - x-amz-request-id
            Id: myCORSRuleId1
            MaxAge: 3600
  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: "PublicReadGetObject"
            Effect: "Allow"
            Action: "s3:GetObject"
            Principal: "*"
            Resource: !Sub "${S3Bucket.Arn}/*"
  CertificateManagerCertificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref DomainName
      SubjectAlternativeNames:
        - !Sub "www.${DomainName}"
      ValidationMethod: DNS
      DomainValidationOptions:
        - DomainName: !Ref DomainName
          HostedZoneId: !Ref HostedZoneId
        - DomainName: !Sub "www.${DomainName}"
          HostedZoneId: !Ref HostedZoneId
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Aliases:
          - !Ref DomainName
          - !Sub "www.${DomainName}"
        CustomErrorResponses:
          - ErrorCachingMinTTL: 60
            ErrorCode: 404
            ResponseCode: 404
            ResponsePagePath: "/home.html"
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          ResponseHeadersPolicyId: !Ref ResponseHeadersPolicy
          DefaultTTL: 86400
          ForwardedValues:
            Cookies:
              Forward: none
            QueryString: true
          MaxTTL: 31536000
          SmoothStreaming: false
          TargetOriginId: !Sub "S3-${AWS::StackName}"
          ViewerProtocolPolicy: "redirect-to-https"
          FunctionAssociations:
            - EventType: viewer-request
              FunctionARN: !GetAtt RedirectFunction.FunctionMetadata.FunctionARN
        DefaultRootObject: "home.html"
        Enabled: true
        HttpVersion: http2
        IPV6Enabled: true
        Origins:
          - CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginKeepaliveTimeout: 5
              OriginProtocolPolicy: "http-only"
              OriginReadTimeout: 30
              OriginSSLProtocols:
                - TLSv1
                - TLSv1.1
                - TLSv1.2
            DomainName: !Join
              - ""
              - - !Ref S3Bucket
                - ".s3-website-"
                - !Ref AWS::Region
                - ".amazonaws.com"
            Id: !Sub "S3-${AWS::StackName}"
        PriceClass: !Ref PriceClass
        ViewerCertificate:
          AcmCertificateArn: !Ref CertificateManagerCertificate
          MinimumProtocolVersion: TLSv1.1_2016
          SslSupportMethod: sni-only
  ResponseHeadersPolicy:
    Type: AWS::CloudFront::ResponseHeadersPolicy
    Properties: 
      ResponseHeadersPolicyConfig: 
        Name: !Sub "${AWS::StackName}-security-headers"
        SecurityHeadersConfig:
          StrictTransportSecurity:
            AccessControlMaxAgeSec: 86400
            IncludeSubdomains: true
            Override: true
            Preload: true
          #ContentSecurityPolicy:
          #  ContentSecurityPolicy: "default-src 'self';"
          #  Override: false
          ContentTypeOptions:
            Override: true
          FrameOptions:
            FrameOption: DENY
            Override: true
          ReferrerPolicy:
            ReferrerPolicy: "same-origin"
            Override: true
          XSSProtection:
            ModeBlock: true
            Override: true
            Protection: true
        CustomHeadersConfig:
          Items:
            - Header: cache-control
              Value: max-age=3600
              Override: true
  RedirectFunction:
    Type: AWS::CloudFront::Function
    Properties:
      AutoPublish: true
      Name: !Sub "${AWS::StackName}-redirects"
      FunctionConfig:
        Comment: !Sub "Redirect to ${DomainName}"
        Runtime: cloudfront-js-1.0
      FunctionCode: !Sub |
        function handler(event) {
            //
            var request = event.request;
            var host = request.headers.host.value;

            if (!host.startsWith("www.")) {
                return {
                    statusCode: 301,
                    statusDescription: "Permanently moved",
                    headers: {
                        location: { value: "https://www." + host },
                    },
                };
            }
            return request;
        }
  Route53RecordSetGroup:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneName: !Sub "${DomainName}."
      RecordSets:
        - Name: !Ref DomainName
          Type: A
          AliasTarget:
            DNSName: !GetAtt CloudFrontDistribution.DomainName
            EvaluateTargetHealth: false
            HostedZoneId: Z2FDTNDATAQYW2 # Not the same as HostedZoneId
        - Name: !Sub "www.${DomainName}"
          Type: A
          AliasTarget:
            DNSName: !GetAtt CloudFrontDistribution.DomainName
            EvaluateTargetHealth: false
            HostedZoneId: Z2FDTNDATAQYW2 # Not the same as HostedZoneId
Outputs:
    WebsiteURL:
        Value: !GetAtt S3Bucket.WebsiteURL
        Description: URL for website hosted on S3
    CloudfrontDomainName:
        Value: !GetAtt CloudFrontDistribution.DomainName
        Description: The CloudFront distribution name