template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  A serverless website with SAM on AWS: https://izifortune.com/serverless-website-sam-aws/


# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 3

Resources:
  LambdaEdgeFunctionRole:
    Type: "AWS::IAM::Role"
    Properties:
      Path: '/'
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Sid: "AllowLambdaServiceToAssumeRole"
            Effect: "Allow"
            Action: 
              - "sts:AssumeRole"
            Principal:
              Service: 
                - "lambda.amazonaws.com"
                - "edgelambda.amazonaws.com"

  RewriteLambda:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: rewrite/
      Description: 'Serverless rewrite lambda'
      Handler: app.lambdaHandler
      Runtime: nodejs12.x
      MemorySize: 128
      Timeout: 1
      Role: !GetAtt LambdaEdgeFunctionRole.Arn
      AutoPublishAlias: live

  SecureHeadersLambda:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: secure-headers/
      Description: 'Add security headers to index.html response'
      Handler: app.lambdaHandler
      Runtime: nodejs10.x
      MemorySize: 128
      Timeout: 1
      Role: !GetAtt LambdaEdgeFunctionRole.Arn
      AutoPublishAlias: live

  CloudFrontOriginAccessIdentity:
    Type: 'AWS::CloudFront::CloudFrontOriginAccessIdentity'
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: 'Serverless website Origin access identity serverless website'

  WebsiteCloudfrontDistribution:
    Type: "AWS::CloudFront::Distribution"
    Properties:
      DistributionConfig:
        Aliases:
            - <ADD YOU ALIASES HERE>
        Comment: "Cloudfront distribution for serverless website"
        ViewerCertificate:
          AcmCertificateArn: <CERT HERE>
          MinimumProtocolVersion: TLSv1.1_2016
          SslSupportMethod: sni-only
        DefaultRootObject: "index.html"
        Enabled: true
        HttpVersion: http2
        Origins:
          - Id: s3-website
            DomainName: !GetAtt Bucket.DomainName
            S3OriginConfig: 
              OriginAccessIdentity: 
                Fn::Sub: 'origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}'
        DefaultCacheBehavior:
          Compress: 'true'
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          ForwardedValues:
            QueryString: false
          TargetOriginId: s3-website
          ViewerProtocolPolicy : redirect-to-https
          LambdaFunctionAssociations:
            - EventType: origin-request
              LambdaFunctionARN: !Ref RewriteLambda.Version
            - EventType: viewer-response
              LambdaFunctionARN: !Ref SecureHeadersLambda.Version

  Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: <YOURSWEBSITE.COM>

  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref Bucket
      PolicyDocument:
        Statement:
          -
            Effect: Allow
            Action: 's3:GetObject'
            Resource:
              - !Sub "arn:aws:s3:::${Bucket}/*"
            Principal:
              AWS: !Sub "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${CloudFrontOriginAccessIdentity}"
  HostedZone:
    Type: AWS::Route53::HostedZone
    Properties: 
      HostedZoneConfig: 
        Comment: yourwebsite.com hosted zone
      Name: yourwebsite.com
  RecordA:
    Type: AWS::Route53::RecordSet
    DependsOn: WebsiteCloudfrontDistribution
    Properties:
      HostedZoneId: !Ref HostedZone
      Name: <yourwebsite>.com
      Type: A
      AliasTarget:
        DNSName: !GetAtt WebsiteCloudfrontDistribution.DomainName
        HostedZoneId: !Ref HostedZone
  RecordAAAA:
    Type: AWS::Route53::RecordSet
    DependsOn: WebsiteCloudfrontDistribution
    Properties:
      HostedZoneId: !Ref HostedZone
      Name: <yourwebsite>.com
      Type: AAAA
      AliasTarget:
        DNSName: !GetAtt WebsiteCloudfrontDistribution.DomainName
        HostedZoneId: !Ref HostedZone
  RecordWWWA:
    Type: AWS::Route53::RecordSet
    DependsOn: WebsiteCloudfrontDistribution
    Properties:
      HostedZoneId: !Ref HostedZone
      Name: www.<yourwebsite>.com
      Type: A
      AliasTarget:
        DNSName: !GetAtt WebsiteCloudfrontDistribution.DomainName
        HostedZoneId: !Ref HostedZone
  RecordWWWAAAA:
    Type: AWS::Route53::RecordSet
    DependsOn: WebsiteCloudfrontDistribution
    Properties:
      HostedZoneId: !Ref HostedZone
      Name: www.<yourwebsite>.com
      Type: AAAA
      AliasTarget:
        DNSName: !GetAtt WebsiteCloudfrontDistribution.DomainName
        HostedZoneId: !Ref HostedZone