cloudformation.yaml

AWSTemplateFormatVersion: 2010-09-09
Parameters:
  GithubOwner:
    Type: String
    Default: dchudz
  GithubRepo:
    Type: String
    Default: PlannedPooling
  GithubOAuthToken:
    NoEcho: true
    Type: String
    Description: "Github personal access token"

Mappings:
  BranchMap:
    plannedpooling:
      branch: master
    plannedpooling-staging:
      branch: staging
Conditions:
  CreateProdResources: !Equals [ !Ref "AWS::StackName" , plannedpooling]
Resources:
  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: PublicRead
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: error.html
  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      PolicyDocument:
        Id: MyPolicy
        Version: 2012-10-17
        Statement:
          - Sid: PublicReadForGetBucketObjects
            Effect: Allow
            Principal: '*'
            Action: 's3:GetObject'
            Resource: !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref S3Bucket
                - /*
      Bucket: !Ref S3Bucket


  CodePipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt CodePipeLineRole.Arn
      ArtifactStore:
        Location: !Ref PipelineBucket
        Type: S3
      Stages:
        -
          Name: Source
          Actions:
            -
              Name: SourceAction
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Provider: GitHub
                Version: 1
              OutputArtifacts:
                -
                  Name: MyApp
              Configuration:
                Owner: !Ref GithubOwner
                Repo: !Ref GithubRepo
                Branch: !FindInMap [BranchMap, !Ref "AWS::StackName", branch]
                OAuthToken: !Ref GithubOAuthToken
        -
          Name: Build
          Actions:
            -
              Name: BuildAction
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              InputArtifacts:
                -
                  Name: MyApp
              OutputArtifacts:
                -
                  Name: MyAppBuild
              Configuration:
                ProjectName: !Ref CodeBuild
            - !If
              - CreateProdResources
              - InputArtifacts:
                  - Name: MyApp
                Name: InvalidateCloudfront
                ActionTypeId:
                    Category: Build
                    Owner: AWS
                    Version: 1
                    Provider: CodeBuild
                OutputArtifacts: []
                Configuration:
                  ProjectName: !Ref InvalidationCloudFront
                RunOrder: 3
              - !Ref AWS::NoValue
  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - "codebuild.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: /service-role/
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: Allow
                Action:
                  - "s3:GetObject"
                  - "s3:GetObjectVersion"
                  - "s3:GetBucketVersioning"
                  - "s3:PutObject"
                Resource:
                  - !GetAtt PipelineBucket.Arn
                  - !Join ['', [!GetAtt PipelineBucket.Arn, "/*"]]
              -
                Effect: Allow
                Action:
                  - "s3:GetObject"
                  - "s3:GetObjectVersion"
                  - "s3:GetBucketVersioning"
                  - "s3:PutObject"
                  - "s3:PutObjectAcl"
                Resource:
                  - !GetAtt S3Bucket.Arn
                  - !Join ['', [!GetAtt S3Bucket.Arn, "/*"]]
              -
                Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                  - "cloudfront:CreateInvalidation"
                Resource:
                  - "*"
  CodePipeLineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - "codepipeline.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: Allow
                Action:
                  - "s3:GetObject"
                  - "s3:GetObjectVersion"
                  - "s3:GetBucketVersioning"
                  - "s3:PutObject"
                Resource:
                  - !GetAtt PipelineBucket.Arn
                  - !Join ['', [!GetAtt PipelineBucket.Arn, "/*"]]
              -
                Effect: Allow
                Action:
                  - "codebuild:BatchGetBuilds"
                  - "codebuild:StartBuild"
                Resource: "*"
  CodeBuild:
    Type: 'AWS::CodeBuild::Project'
    Properties:
      Name: !Sub ${AWS::StackName}-CodeBuild
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Artifacts:
        Type: CODEPIPELINE
        Name: MyProject
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Type: LINUX_CONTAINER
        Image: "aws/codebuild/nodejs:8.11.0"
      Source:
        Type: CODEPIPELINE
        BuildSpec: !Sub |
          version: 0.1
          phases:
            pre_build:
              commands:
                - echo Installing source NPM dependencies...
                - npm install
            build:
              commands:
                - echo Build started on `date`
                - npm run build
            post_build:
              commands:
                - aws s3 cp --recursive --acl public-read ./build s3://${S3Bucket}/
                - aws s3 cp --acl public-read --cache-control="max-age=0, no-cache, no-store, must-revalidate" ./build/service-worker.js s3://${S3Bucket}/
                - aws s3 cp --acl public-read --cache-control="max-age=0, no-cache, no-store, must-revalidate" ./build/index.html s3://${S3Bucket}/
          artifacts:
            files:
              - '**/*'
            base-directory: build
  InvalidationCloudFront:
    Condition: CreateProdResources
    Type: 'AWS::CodeBuild::Project'
    Properties:
      Name: !Sub ${AWS::StackName}-InvalidationCloudFront
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Artifacts:
        Type: no_artifacts
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Type: LINUX_CONTAINER
        Image: "aws/codebuild/nodejs:8.11.0"
      Source:
        Type: NO_SOURCE
        BuildSpec: !Sub |
          version: 0.1
          phases:
            pre_build:
              commands:
                - echo 'in prebuild'
            build:
              commands:
                - echo Build started on `date`
            post_build:
              commands:
                - aws cloudfront create-invalidation --distribution-id ${Distribution} --paths /index.html /service-worker.js
  PipelineBucket:
    Type: 'AWS::S3::Bucket'
    Properties: {}
  LogsBucket:
    Condition: CreateProdResources
    Type: AWS::S3::Bucket
    Properties: {}
  WebsiteDNSNameRoot:
    Condition: CreateProdResources
    Type: AWS::Route53::RecordSet
    Properties:
      Type: A
      HostedZoneName: plannedpooling.com.
      Name: plannedpooling.com.
      AliasTarget:
        HostedZoneId: Z2FDTNDATAQYW2
        DNSName: !GetAtt [Distribution, DomainName]
  WebsiteDNSName:
    Type: AWS::Route53::RecordSet
    Condition: CreateProdResources
    Properties:
      HostedZoneName: plannedpooling.com.
      Comment: CNAME redirect custom name to CloudFront distribution
      Name: !Join ['', [!Ref 'AWS::StackName', !Ref 'AWS::AccountId', ., !Ref 'AWS::Region',
          ., 'plannedpooling.com']]
      Type: CNAME
      TTL: '900'
      ResourceRecords:
      - !GetAtt [Distribution, DomainName]
  WebsiteDNSNameHi:
    Type: AWS::Route53::RecordSet
    Condition: CreateProdResources
    Properties:
      HostedZoneName: plannedpooling.com.
      Comment: CNAME redirect custom name to CloudFront distribution
      Name: hi.plannedpooling.com
      Type: CNAME
      TTL: '900'
      ResourceRecords:
      - !GetAtt [Distribution, DomainName]
  WebsiteDNSNameWww:
    Condition: CreateProdResources
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneName: plannedpooling.com.
      Comment: CNAME redirect custom name to CloudFront distribution
      Name: www.plannedpooling.com
      Type: CNAME
      TTL: '900'
      ResourceRecords:
      - !GetAtt [Distribution, DomainName]
  Distribution:
    Type: "AWS::CloudFront::Distribution"
    Condition: CreateProdResources
    Properties:
      DistributionConfig:
        Aliases:
          - hi.plannedpooling.com
          - www.plannedpooling.com
          - plannedpooling.com
        ViewerCertificate:
          AcmCertificateArn: arn:aws:acm:us-east-1:121866893048:certificate/483975ca-686b-4925-9f0f-8bca30841ecb
          SslSupportMethod: sni-only
        Logging:
          IncludeCookies: 'false'
          Bucket: !GetAtt LogsBucket.DomainName
          Prefix: cloudfront
        Origins:
          -
            DomainName: !GetAtt S3Bucket.DomainName
            Id: !Ref S3Bucket
            S3OriginConfig:
              OriginAccessIdentity: ''
        DefaultRootObject: index.html
        Enabled: true
        DefaultCacheBehavior:
          MinTTL: 86400
          MaxTTL: 31536000
          ForwardedValues:
            QueryString: true
          TargetOriginId: !Ref S3Bucket
          ViewerProtocolPolicy: "redirect-to-https"

Outputs:
  StackName:
    Value: AWS::StackName
  WebsiteURL:
    Value: !GetAtt
      - S3Bucket
      - WebsiteURL
    Description: URL for website hosted on S3
  BucketName:
    Value: !Ref 'S3Bucket'
    Description: bucket name
  S3BucketSecureURL:
    Value: !Join
      - ''
      - - 'https://'
        - !GetAtt
          - S3Bucket
          - DomainName
    Description: Name of S3 bucket to hold website content