stack.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Create a static website on S3 served by CloudFront'
Parameters:
  DomainName:
    Type: String
    Description: The domain name for the site
    AllowedPattern: (?!-)[a-zA-Z0-9-.]{1,63}(?<!-)
    ConstraintDescription: must be a valid DNS zone name.
  AcmCertificateArn:
    Type: String
    Description: the Amazon Resource Name (ARN) of an AWS Certificate Manager (ACM) certificate.
    AllowedPattern: "arn:aws:acm:.*"
  S3BucketName:
    Type: String
    Description: Name for the bucket hosting the website
  S3ApexBucketName:
    Type: String
    Description: Name for the apex bucket
Resources:
  S3BucketForWebsiteContent:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref 'S3BucketName'
      WebsiteConfiguration:
        IndexDocument: index.html
        # Redirect
        ErrorDocument: /error/404/index.html
        RoutingRules:
          - RoutingRuleCondition:
              HttpErrorCodeReturnedEquals: '404'
              KeyPrefixEquals: /
            RedirectRule:
              HostName: !Ref 'DomainName'
              ReplaceKeyPrefixWith: error/404/
  S3BucketForApex:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref 'S3ApexBucketName'
      WebsiteConfiguration:
        RedirectAllRequestsTo:
          HostName: !Sub 'www.${DomainName}'
          Protocol: 'https'
  WebsiteCloudfront:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Comment: Cloudfront Distribution pointing to S3 bucket
        Origins:
        - DomainName: !Join [ '', !Split [ 'http://', !GetAtt 'S3BucketForWebsiteContent.WebsiteURL' ] ]
          Id: S3Origin
          CustomOriginConfig:
            OriginProtocolPolicy: 'http-only'
        Enabled: true
        HttpVersion: 'http2'
        # DefaultRootObject: index.html
        Aliases:
        - !Sub 'www.${DomainName}'
        CustomErrorResponses:
          - ErrorCode: 403
            ResponseCode: 404
            ResponsePagePath: '/error/404/index.html'
        DefaultCacheBehavior:
          AllowedMethods:
          - GET
          - HEAD
          - OPTIONS
          Compress: true
          TargetOriginId: S3Origin
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          ViewerProtocolPolicy: redirect-to-https
          ResponseHeadersPolicyId: !Ref WebsiteCloudFrontPolicies
        PriceClass: PriceClass_All
        ViewerCertificate:
          AcmCertificateArn: !Ref 'AcmCertificateArn'
          SslSupportMethod: sni-only
  WebsiteApexCloudfront:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Comment: Cloudfront Distribution pointing to the apex S3 bucket to redirect to www for HTTPS
        Origins:
        - DomainName: !Join [ '', !Split [ 'http://', !GetAtt 'S3BucketForApex.WebsiteURL' ] ]
          Id: S3Origin
          CustomOriginConfig:
            OriginProtocolPolicy: 'http-only'
        Enabled: true
        HttpVersion: 'http2'
        # DefaultRootObject: index.html
        Aliases:
        - !Sub '${DomainName}'
        DefaultCacheBehavior:
          AllowedMethods:
          - GET
          - HEAD
          - OPTIONS
          Compress: true
          TargetOriginId: S3Origin
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          ViewerProtocolPolicy: redirect-to-https
          ResponseHeadersPolicyId: !Ref WebsiteCloudFrontPolicies
        PriceClass: PriceClass_All
        ViewerCertificate:
          AcmCertificateArn: !Ref 'AcmCertificateArn'
          SslSupportMethod: sni-only
  WebsiteCloudFrontPolicies:
    Type: AWS::CloudFront::ResponseHeadersPolicy
    Properties:
      ResponseHeadersPolicyConfig:
        Name: AreWeServerYet-SecurityHeaderPolicy
        Comment: The AreWeServerYet security header policy
        CustomHeadersConfig:
          Items:
            - Header: Permissions-Policy
              Value: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
              Override: false
            - Header: server
              Value: 'AreWeServerYet'
              Override: true
        SecurityHeadersConfig:
          ContentSecurityPolicy:
              ContentSecurityPolicy: default-src 'none'; script-src 'self'; img-src 'self'; style-src 'self'; font-src 'self'
              Override: false
          ContentTypeOptions:
            Override: false
          FrameOptions:
            FrameOption: DENY
            Override: false
          ReferrerPolicy:
            ReferrerPolicy: strict-origin-when-cross-origin
            Override: false
          StrictTransportSecurity:
            AccessControlMaxAgeSec: 63072000
            IncludeSubdomains: true
            Preload: false
            Override: false
          XSSProtection:
            ModeBlock: true
            Protection: true
            Override: false
  WebsiteRoute53:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneId: Z05116532RL9IYBYJ5EC5
      RecordSets:
      - Name: www.areweserveryet.org
        Type: A
        AliasTarget:
          DNSName: !GetAtt WebsiteCloudfront.DomainName
          EvaluateTargetHealth: false
          HostedZoneId: Z2FDTNDATAQYW2 # From AWS docs: This is always the hosted zone ID when you create an alias record that routes traffic to a CloudFront distribution.
      - Name: www.areweserveryet.org
        Type: AAAA
        AliasTarget:
          DNSName: !GetAtt WebsiteCloudfront.DomainName
          EvaluateTargetHealth: false
          HostedZoneId: Z2FDTNDATAQYW2 # From AWS docs: This is always the hosted zone ID when you create an alias record that routes traffic to a CloudFront distribution.
      - Name: areweserveryet.org
        Type: A
        AliasTarget:
          DNSName: !GetAtt WebsiteApexCloudfront.DomainName
          EvaluateTargetHealth: false
          HostedZoneId: Z2FDTNDATAQYW2 # From AWS docs: This is always the hosted zone ID when you create an alias record that routes traffic to a CloudFront distribution.
      - Name: areweserveryet.org
        Type: AAAA
        AliasTarget:
          DNSName: !GetAtt WebsiteApexCloudfront.DomainName
          EvaluateTargetHealth: false
          HostedZoneId: Z2FDTNDATAQYW2 # From AWS docs: This is always the hosted zone ID when you create an alias record that routes traffic to a CloudFront distribution.

Outputs:
  CloudFrontID:
    Description: 'CloudFront distribution id'
    Value: !GetAtt WebsiteCloudfront.Id