app.yml

---
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: An AWS CloudFormation stack to run a serverless password-protected photo gallery

Parameters:
  websiteTitle:
    Description: Title to be displayed on the website
    Type: String
  webBucket:
    Description: Bucket to store published website
    Type: String
  sourceBucket:
    Description: Bucket to store site data such as original pictures and metadata
    Type: String
  resizedBucket:
    Description: Bucket to store resized pictures
    Type: String
  originAccessIdentity:
    Description: CloudFront OAI
    Type: String
  website:
    Description: Actual website
    Type: String
  sessionDuration:
    Description: Number of seconds the user has access to the file
    Type: Number
  kmsKeyId:
    Description: ID of the KMS key used to encrypt other parameters
    Type: String
    NoEcho: true
  cloudFrontKeypairId:
    Description: CloudFront keypair ID encrypted with KMS
    Type: String
    Default: ''
    NoEcho: true
  encryptedCloudFrontPrivateKey:
    Description: CloudFront private key encrypted with KMS
    Type: String
    NoEcho: true
  encryptedHtpasswd:
    Description: htpasswd file contents encrypted with KMS
    Type: String
    NoEcho: true

Resources:

  #
  # Login Lambda function definition
  #
  LoginFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.handler
      Runtime: nodejs8.10
      CodeUri: dist/lambda-login.zip
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          WEBSITE_DOMAIN: !Ref website
          SESSION_DURATION: !Ref sessionDuration
          CLOUDFRONT_KEYPAIR_ID: !Ref cloudFrontKeypairId
          ENCRYPTED_CLOUDFRONT_PRIVATE_KEY: !Ref encryptedCloudFrontPrivateKey
          ENCRYPTED_HTPASSWD: !Ref encryptedHtpasswd
      Events:
        GetResource:
          Type: Api
          Properties:
            Path: /login
            Method: post

  #
  # Login IAM role so the Lambda can log (CloudWatch) and decrypt secrets (KMS)
  #
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowLambdaServiceToAssumeRole
            Effect: Allow
            Action: ['sts:AssumeRole']
            Principal:
              Service: [lambda.amazonaws.com]
      Policies:
        - PolicyName: KmsDecrypt
          PolicyDocument:
            Statement:
              - Effect: Allow
                Resource: !Sub
                  - arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/${id}
                  - id: !Ref kmsKeyId
                Action: ['kms:Decrypt']

  #
  # Resize Lambda function definition
  #
  ResizeFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.handler
      Runtime: nodejs8.10
      CodeUri: dist/lambda-resize.zip
      Role: !GetAtt ResizeLambdaRole.Arn
      Environment:
        Variables:
          RESIZED_BUCKET: !Ref resizedBucket
      Timeout: 30
      MemorySize: 1024

  #
  # Resize IAM role so the Lambda can log (CloudWatch) and read/write S3 objects
  #
  ResizeLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowLambdaServiceToAssumeRole
            Effect: Allow
            Action: ['sts:AssumeRole']
            Principal:
              Service: [lambda.amazonaws.com]
      Policies:
        - PolicyName: ResizeLambdaGetOriginal
          PolicyDocument:
            Statement:
              - Effect: Allow
                Resource: !Sub
                  - 'arn:aws:s3:::${sourceBucket}/*'
                  - sourceBucket: !Ref sourceBucket
                Action: ['s3:GetObject']
        - PolicyName: ResizeLambdaPutResized
          PolicyDocument:
            Statement:
              - Effect: Allow
                Resource: !Sub
                  - 'arn:aws:s3:::${resizedBucket}/*'
                  - resizedBucket: !Ref resizedBucket
                Action: ['s3:PutObject']

  #
  # Site Builder Lambda function definition
  #
  SiteBuilderFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.handler
      Runtime: nodejs8.10
      CodeUri: dist/lambda-site-builder.zip
      Environment:
        Variables:
          WEBSITE_TITLE: !Ref websiteTitle
          CLOUDFRONT_DISTRIBUTION_DOMAIN:
            !GetAtt WebDistribution.DomainName
          ORIGINAL_BUCKET: !Ref sourceBucket
          SITE_BUCKET: !Ref webBucket
          WEBSITE: !Ref website
      Role: !GetAtt SiteBuilderLambdaRole.Arn
      Timeout: 30
      MemorySize: 1024

  #
  # Site Builder IAM role so the Lambda can log (CloudWatch) and read/write S3 objects
  #
  SiteBuilderLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowLambdaServiceToAssumeRole
            Effect: Allow
            Action: ['sts:AssumeRole']
            Principal:
              Service: [lambda.amazonaws.com]
      Policies:
        - PolicyName: SiteBuilderLambdaGetOriginal
          PolicyDocument:
            Statement:
              - Effect: Allow
                Resource: !Sub
                  - 'arn:aws:s3:::${sourceBucket}/*'
                  - sourceBucket: !Ref sourceBucket
                Action: ['s3:GetObject']
        - PolicyName: SiteBuilderLambdaListOriginal
          PolicyDocument:
            Statement:
              - Effect: Allow
                Resource: !Sub
                  - 'arn:aws:s3:::${sourceBucket}'
                  - sourceBucket: !Ref sourceBucket
                Action: ['s3:ListBucket']
        - PolicyName: SiteBuilderLambdaPutSite
          PolicyDocument:
            Statement:
              - Effect: Allow
                Resource: !Sub
                  - 'arn:aws:s3:::${webBucket}/*'
                  - webBucket: !Ref webBucket
                Action: ['s3:PutObject']
        - PolicyName: SiteBuilderLambdaInvalidateDistribution
          PolicyDocument:
            Statement:
              - Effect: Allow
                Resource: '*'
                Action:
                  - cloudfront:CreateInvalidation
                  - cloudfront:ListDistributions

  #
  # Source Bucket
  #
  ResizeInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref ResizeFunction
      Principal: s3.amazonaws.com
      SourceAccount: !Ref AWS::AccountId
      SourceArn: !Sub
        - arn:aws:s3:::${sourceBucket}
        - sourceBucket: !Ref sourceBucket
  SourceBucket:
    Type: AWS::S3::Bucket
    DependsOn: ResizeInvokePermission
    Properties:
      BucketName: !Ref sourceBucket
      NotificationConfiguration:
        LambdaConfigurations:
          - Event: 's3:ObjectCreated:*'
            Function: !GetAtt ResizeFunction.Arn
  SourceBucketPolicy:
    Type: AWS::S3::BucketPolicy
    DependsOn: SourceBucket
    Properties:
      Bucket: !Ref SourceBucket
      PolicyDocument:
        Statement:
          - Action:
              - s3:GetObject
            Effect: Allow
            Resource: !Sub
              - '${bucket}/*'
              - bucket: !GetAtt SourceBucket.Arn
            Principal:
              AWS: !Sub
                - arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${id}
                - id: !Ref originAccessIdentity

  #
  # Resized Bucket
  #
  SiteBuilderInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref SiteBuilderFunction
      Principal: s3.amazonaws.com
      SourceAccount: !Ref AWS::AccountId
      SourceArn: !Sub
        - arn:aws:s3:::${resizedBucket}
        - resizedBucket: !Ref resizedBucket
  ResizedBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref resizedBucket
      NotificationConfiguration:
        LambdaConfigurations:
          - Event: 's3:ObjectCreated:*'
            Function: !GetAtt SiteBuilderFunction.Arn
  ResizedBucketPolicy:
    Type: AWS::S3::BucketPolicy
    DependsOn: ResizedBucket
    Properties:
      Bucket: !Ref ResizedBucket
      PolicyDocument:
        Statement:
          - Action:
              - s3:GetObject
            Effect: Allow
            Resource: !Sub
              - '${bucket}/*'
              - bucket: !GetAtt ResizedBucket.Arn
            Principal:
              AWS: !Sub
                - arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${id}
                - id: !Ref originAccessIdentity

  #
  # Web Bucket
  #
  WebBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref webBucket
  WebBucketPolicy:
    Type: AWS::S3::BucketPolicy
    DependsOn: WebBucket
    Properties:
      Bucket: !Ref WebBucket
      PolicyDocument:
        Statement:
          - Action:
              - s3:GetObject
            Effect: Allow
            Resource: !Sub
              - '${bucket}/*'
              - bucket: !GetAtt WebBucket.Arn
            Principal:
              AWS: !Sub
                - arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${id}
                - id: !Ref originAccessIdentity

  #
  # SSL Certificate
  #
  SSLCert:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref website

  #
  # CloudFront Distribution
  #
  WebDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Aliases:
          - !Ref website
        Origins:
          - DomainName: !Sub
              - ${resizedBucket}.s3.amazonaws.com
              - resizedBucket: !Ref resizedBucket
            Id: S3-ResizedBucket
            S3OriginConfig:
              OriginAccessIdentity: !Sub
                - origin-access-identity/cloudfront/${id}
                - id: !Ref originAccessIdentity
          - DomainName: !Sub
              - ${sourceBucket}.s3.amazonaws.com
              - sourceBucket: !Ref sourceBucket
            Id: S3-SourceBucket
            S3OriginConfig:
              OriginAccessIdentity: !Sub
                - origin-access-identity/cloudfront/${id}
                - id: !Ref originAccessIdentity
          - DomainName: !Sub
              - ${webBucket}.s3.amazonaws.com
              - webBucket: !Ref webBucket
            Id: S3-WebBucket
            S3OriginConfig:
              OriginAccessIdentity: !Sub
                - origin-access-identity/cloudfront/${id}
                - id: !Ref originAccessIdentity
          - DomainName: !Sub
              - ${apiID}.execute-api.${AWS::Region}.amazonaws.com
              - apiID: !Ref ServerlessRestApi
            Id: Custom-LoginAPI
            CustomOriginConfig:
              OriginProtocolPolicy: https-only
        CacheBehaviors:
          - TargetOriginId: S3-ResizedBucket
            TrustedSigners:
              - self
            ViewerProtocolPolicy: https-only
            PathPattern: 'pics/resized/*'
            ForwardedValues:
              QueryString: 'false'
          - TargetOriginId: S3-SourceBucket
            TrustedSigners:
              - self
            ViewerProtocolPolicy: https-only
            PathPattern: 'pics/original/*'
            ForwardedValues:
              QueryString: 'false'
          - TargetOriginId: Custom-LoginAPI
            ViewerProtocolPolicy: https-only
            PathPattern: 'Prod/*'
            AllowedMethods:
              - HEAD
              - DELETE
              - POST
              - GET
              - OPTIONS
              - PUT
              - PATCH
            ForwardedValues:
              QueryString: 'false'
              Headers:
                - Accept
                - Authorization
                - Content-Type
                - Referer
        Enabled: 'true'
        DefaultRootObject: index.html
        CustomErrorResponses:
          - ErrorCode: 403
            ResponsePagePath: /error.html
            ResponseCode: 403
          - ErrorCode: 404
            ResponsePagePath: /index.html
            ResponseCode: 404
        DefaultCacheBehavior:
          TargetOriginId: S3-WebBucket
          TrustedSigners:
            - self
          ForwardedValues:
            QueryString: 'false'
          ViewerProtocolPolicy: redirect-to-https
        PriceClass: PriceClass_All
        ViewerCertificate:
          AcmCertificateArn: !Ref SSLCert
          SslSupportMethod: sni-only