serverless-blog-s3.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: CI/CD + S3 bucket Hosting static Hugo blog 

#-------------------------------------------------------------------------------
#--[ PARAMETERS ]---------------------------------------------------------------
#-------------------------------------------------------------------------------

Parameters:

  BuildBucket:
    Description: S3 Build bucket
    Type: String

  BucketName:
    Description: S3 website bucket
    Type: String

  CacheControlMaxAge:
    Description: Cache Control for S3 synchronization (default 5 min)
    Type: Number
    Default: 300

  GitHubUser:
    Description: GitHub user
    Type: String

  GitHubRepo:
    Description: GitHub repository
    Type: String

  GitHubBranch:
    Description: GitHub branch
    Type: String

  GitHubToken:
    Description: GitHub personal token
    Type: String
    NoEcho: true

  AcmCertificateArn:
    Description: Certificate Arn for cloudfront
    Type: String
  
  DomainName:
    Description: Register new domain name
    Type: String

#-------------------------------------------------------------------------------
#--[ RESOURCES ]----------------------------------------------------------------
#-------------------------------------------------------------------------------

Resources:

  S3WebsiteBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: error.html
    DeletionPolicy: Retain

  S3BuildBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BuildBucket

  WebsiteBucketPolicy: 
    Type: AWS::S3::BucketPolicy
    Properties: 
      Bucket: !Ref S3WebsiteBucket
      PolicyDocument: 
        Statement: 
          - Action: 
              - s3:GetObject
            Effect: Allow
            Resource: 
              Fn::Join: 
                - ""
                - 
                  - "arn:aws:s3:::"
                  - 
                    Ref: "S3WebsiteBucket"
                  - "/*"
            Principal: "*"

  CodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: HugoAWSCodeBuildServiceRole
      Path: /
      AssumeRolePolicyDocument: |
        {
            "Statement": [{
                "Effect": "Allow",
                "Principal": { "Service": [ "codebuild.amazonaws.com" ]},
                "Action": [ "sts:AssumeRole" ]
            }]
        }
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource: "*"
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - iam:*
              - Resource:
                  - !Sub arn:aws:s3:::${BucketName}/*
                  - !Sub arn:aws:s3:::${BucketName}
                Effect: Allow
                Action:
                  - s3:*
              - Resource:
                  - !Sub arn:aws:s3:::${BuildBucket}/*
                  - !Sub arn:aws:s3:::${BuildBucket}
                
                Effect: Allow
                Action:
                  - s3:Get*

  CodePipelineServiceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: HugoAWSCodePipelineServiceRole
      Path: /
      AssumeRolePolicyDocument: |
        {
            "Statement": [{
                "Effect": "Allow",
                "Principal": { "Service": [ "codepipeline.amazonaws.com" ]},
                "Action": [ "sts:AssumeRole" ]
            }]
        }
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource:
                  - !Sub arn:aws:s3:::${BuildBucket}/*
                  - !Sub arn:aws:s3:::${BuildBucket}
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
              - Resource: "*"
                Effect: Allow
                Action:
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds


#--[ CodeBuild ]--------------------------------------------------------
  
  CodeBuild:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: "CODEPIPELINE"
      Source:
        Type: "CODEPIPELINE"
      Environment:
        ComputeType: "BUILD_GENERAL1_SMALL"
        Image: "node:8-alpine"
        Type: "LINUX_CONTAINER"
        EnvironmentVariables:
          - Name: AWS_DEFAULT_REGION
            Value: !Ref AWS::Region
          - Name: BUCKET_NAME
            Value: !Ref BucketName
          - Name: CACHE_CONTROL_MAX_AGE
            Value: !Ref CacheControlMaxAge
          - Name: BRANCH
            Value: !Ref GitHubBranch
          - Name: REPO
            Value: !Ref GitHubRepo
          - Name: USER
            Value: !Ref GitHubUser
      Name: !Ref GitHubRepo
      ServiceRole: !GetAtt CodeBuildServiceRole.Arn

#--[ CodePipeline ]-------------------------------------------------------------
  CodePipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Name: !Ref GitHubRepo
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref BuildBucket
      Stages:
        - Name: "Source"
          Actions:
            - Name: "Download_Source"
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: 1
                Provider: GitHub
              Configuration:
                Owner: !Ref GitHubUser
                Repo: !Ref GitHubRepo
                Branch: !Ref GitHubBranch
                OAuthToken: !Ref GitHubToken
              OutputArtifacts:
                - Name: source
              RunOrder: 1
        - Name: "Build"
          Actions:
            - Name: "Build_and_deploy"
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref CodeBuild
              InputArtifacts:
                - Name: source
              OutputArtifacts:
                - Name: build
              RunOrder: 1

#--[ Content delivery ]--------------------------------------------------
  
  CloudfrontDistribution:
    Type: 'AWS::CloudFront::Distribution'
    Properties:
      DistributionConfig:
        Origins:
        - DomainName: !Select [2, !Split ["/", !GetAtt S3WebsiteBucket.WebsiteURL]]
          Id: S3Website
          CustomOriginConfig:
            OriginProtocolPolicy: http-only
        Enabled: true
        HttpVersion: 'http2'
        DefaultRootObject: index.html
        Aliases: 
        - !Join ['', ['hugoblog.', !Ref DomainName]]
        DefaultCacheBehavior:
          AllowedMethods: ["HEAD", "GET"]
          Compress: false
          TargetOriginId: S3Website
          ForwardedValues:
            QueryString: 'true'
          ViewerProtocolPolicy: redirect-to-https
        PriceClass: PriceClass_All
        ViewerCertificate:
          AcmCertificateArn: !Ref AcmCertificateArn
          SslSupportMethod: sni-only

  DNSRecordSet:          
    Type: "AWS::Route53::RecordSet"
    Properties: 
      AliasTarget:
        DNSName: !GetAtt CloudfrontDistribution.DomainName
        HostedZoneId: Z2FDTNDATAQYW2
      Comment: Recordset to the cloudfront distribution
      HostedZoneName: !Join ['',[!Ref DomainName,'.']]
      Name: !Join ['', ['hugoblog.', !Ref DomainName]]
      Type: A


#----------------------------------------------------------------------------------------------
#--[ OUTPUTS ]---------------------------------------------------------------------------------
#----------------------------------------------------------------------------------------------

Outputs:
  BlogURL:
    Value: !GetAtt [S3WebsiteBucket, WebsiteURL]
    Description: URL for website hosted on S3
    Export:
      Name: BlogURL

  S3BucketSecureURL:
    Value: !Join ['', ['https://', !GetAtt [S3WebsiteBucket, DomainName]]]
    Description: Name of S3 bucket to hold website content
    Export:
      Name: BlogSecureURL