serverless-cloudfront.yml

service: cf-nostr-image-services-${sls:stage}

provider:
  name: aws
  runtime: nodejs16.x
  region: us-east-1
  architecture: x86_64
  timeout: 29

package:
  individually: true
  patterns:
    - '!serverless.yml'
    - '!serverless-cloudfront.yml'
    - '!variables.sample.yml'
    - '!variables.yml'
  
custom:
  S3_BUCKET: ${file(./variables.yml):S3_BUCKET}
  CF_CUSTOM_DOMAIN: ${file(./variables.yml):CF_CUSTOM_DOMAIN}
  ROUTE53_ZONE_ID: ${file(./variables.yml):ROUTE53_ZONE_ID}

resources:
  Resources:
    CertificateNstr:
      Type: AWS::CertificateManager::Certificate
      Properties:
        DomainName: ${self:custom.CF_CUSTOM_DOMAIN}
        ValidationMethod: DNS
        DomainValidationOptions:
          - DomainName: ${self:custom.CF_CUSTOM_DOMAIN}
            HostedZoneId: ${self:custom.ROUTE53_ZONE_ID}
    Route53Nstr:
      Type: AWS::Route53::RecordSetGroup
      Properties:
        HostedZoneId: ${self:custom.ROUTE53_ZONE_ID}
        RecordSets:
          - Name: ${self:custom.CF_CUSTOM_DOMAIN}
            Type: A
            AliasTarget:
              HostedZoneId: Z2FDTNDATAQYW2 # Cloudfront hardcoded zone id
              DNSName: !GetAtt CloudFrontDistributionNstr.DomainName

    CloudFrontOriginIdentityNstr:
      Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
      Properties:
        CloudFrontOriginAccessIdentityConfig:
          Comment: 'origin identity'
    CloudFrontDistributionNstr:
      Type: AWS::CloudFront::Distribution
      Properties:
          DistributionConfig:
            DefaultRootObject:  index.html
            Aliases:
              - ${self:custom.CF_CUSTOM_DOMAIN}
            ViewerCertificate:
              AcmCertificateArn: !Ref CertificateNstr
              SslSupportMethod: sni-only
              MinimumProtocolVersion: TLSv1.2_2021
            PriceClass: PriceClass_100
            Enabled: true
            Origins:
              - DomainName: !GetAtt S3BucketNstr.DomainName
                Id: { Ref: S3BucketNstr }
                S3OriginConfig:

                  OriginAccessIdentity: !Join
                    - ''
                    - - origin-access-identity/cloudfront/
                      - !Ref CloudFrontOriginIdentityNstr
            DefaultCacheBehavior:
              TargetOriginId: { Ref: S3BucketNstr }
              CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad
              ForwardedValues:
                QueryString: false
                Cookies:
                  Forward: none
              AllowedMethods:
                - GET
                - HEAD
                - OPTIONS
              ViewerProtocolPolicy: redirect-to-https
              
            CacheBehaviors:
              - PathPattern: /images/*
                TargetOriginId: { Ref: S3BucketNstr }
                CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6
                ForwardedValues:
                  QueryString: true
                  Cookies:
                    Forward: none
                AllowedMethods:
                  - GET
                  - HEAD
                  - OPTIONS
                ViewerProtocolPolicy: redirect-to-https
              - PathPattern: /*
                TargetOriginId: { Ref: S3BucketNstr }
                #CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6
                CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad
                ForwardedValues:
                  QueryString: true
                  Cookies:
                    Forward: none
                AllowedMethods:
                  - GET
                  - HEAD
                  - OPTIONS
                ViewerProtocolPolicy: redirect-to-https


      
  # create S3 bucket 
    S3BucketNstr:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${self:custom.S3_BUCKET}
        # intelligent tiering
        IntelligentTieringConfigurations:
          - Id: 1
            Status: Enabled
            Tierings:
              - AccessTier: ARCHIVE_ACCESS
                Days: 90
          - Id: tier2
            Status: Enabled
            Tierings:
              - AccessTier: DEEP_ARCHIVE_ACCESS
                Days: 180

        
    S3BucketPolicy: # Allow uploaded files to be public and downloadable
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket: { Ref: S3BucketNstr }
        PolicyDocument:
          Statement:
            - Action:
                - 's3:GetObject'
              Effect: 'Allow'
              Resource: { Fn::Join: ['', [{ Fn::GetAtt: [S3BucketNstr, Arn] }, '/*']] } # arn:aws:s3:::bucketName/*
              Principal: 
                AWS: !Sub 'arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${CloudFrontOriginIdentityNstr}'
  Outputs:
    S3BucketNstr:
      Value: { Ref: S3BucketNstr }
      Export:
        Name: S3BucketNstr
    CloudFrontDistributionNstr:
      Value: { Ref: CloudFrontDistributionNstr }
      Export:
        Name: CloudFrontDistributionNstr
      # export distribution domain name
    CloudFrontDistributionDomainNameNstr:
      Value: !GetAtt CloudFrontDistributionNstr.DomainName
      Export:
        Name: CloudFrontDistributionDomainNameNstr
    CloudFrontOriginIdentityNstr:
      Value: { Ref: CloudFrontOriginIdentityNstr }
      Export:
        Name: CloudFrontOriginIdentityNstr