cf_stack.yml

---
AWSTemplateFormatVersion: "2010-09-09"

Description: "Static Site Generation Stack"

Parameters:
  
  #Domain name used for your static site
  DomainName: 
    Type: String
    MinLength: 4
    MaxLength: 253
    Default: "blog.fxaugury.com"
    AllowedPattern: "[a-z0-9]+[-.a-z0-9]*(\\.[a-z][a-z]+)+"

  #CodeCommit repo
  ExistingGitRepository:
    Description: "Git repository name for CodeCommit repository."
    Type: String
    Default: ""

  #CodePipeline source code bucket
  ExistingCodePipelineBucket:
    Description: "Name of CodePipeline artifact bucket. Leave empty and it will be created for you."
    Type: String
    Default: ""
  
  #Lambda parameters
  GeneratorLambdaFunctionRuntime:
    Type: String
    Description: "Runtime language of Static Site Generator AWS Lambda function"
    Default: "python3.6"
    AllowedValues:
      - "python3.6"
      - "nodejs"
      - "java8"
  
  GeneratorLambdaFunctionHandler:
    Type: String
    Description: "Function Handler for AWS Lambda function"
    Default: "generate_static_site.handler"
  
  #S3 buckets
  ExistingSiteBucket:
    Description: "Name of website bucket."
    Type: String
    Default: "blog.fxaugury.com"

  GeneratorLambdaFunctionS3Bucket:
    Type: String
    Description: "S3 bucket containing ZIP of AWS Lambda function"
    Default: ""

  GeneratorLambdaFunctionS3Key:
    Type: String
    Description: "S3 key containing ZIP of AWS Lambda function"
    Default: "generate_static_site.zip"

Conditions:
  RequiresCodePipelineBucket: !Equals [!Ref ExistingCodePipelineBucket, ""]

Resources:
  #S3 temporary storage for CodeCommit source code, remove after 24 hours daily
  CodePipelineBucket:
    Condition: RequiresCodePipelineBucket
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub "src.${DomainName}"
      LifecycleConfiguration:
        Rules:
          ExpirationInDays: 1
    DeletionPolicy: Delete
  
  #Allow Lambda access to; List, upload, get, delete, put object or acl on S3 and Set job results on CodePipeline
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: !Sub "${DomainName}-execution-policy"
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: "logs:*"
                Resource: "arn:aws:logs:*:*:*"
              - Effect: Allow
                Action:
                  - codepipeline:PutJobSuccessResult
                  - codepipeline:PutJobFailureResult
                Resource: "*"
              - Effect: Allow
                Action:
                  - s3:GetBucketLocation
                  - s3:ListBucket
                  - s3:ListBucketMultipartUploads
                  - s3:AbortMultipartUpload
                  - s3:DeleteObject
                  - s3:GetObject
                  - s3:GetObjectAcl
                  - s3:ListMultipartUploadParts
                  - s3:PutObject
                  - s3:PutObjectAcl
                Resource:
                  - !Join ["", ["arn:aws:s3:::", !Ref ExistingSiteBucket, "/*"]]
                  - !Join ["", ["arn:aws:s3:::", !Ref ExistingCodePipelineBucket, "/*"]]

  GeneratorLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Description: !Sub "Static site generator for ${DomainName}"
      Role: !GetAtt LambdaExecutionRole.Arn
      MemorySize: 256
      Timeout: 300
      Runtime: !Ref GeneratorLambdaFunctionRuntime
      Handler: !Ref GeneratorLambdaFunctionHandler
      Code:
        S3Bucket: !Ref GeneratorLambdaFunctionS3Bucket
        S3Key: !Ref GeneratorLambdaFunctionS3Key
      Environment:
        Variables:
          SiteBucket: !Ref ExistingSiteBucket

  # Allow all actions on Lambda and CodePipeline
  CodePipelineRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - "lambda.amazonaws.com"
                - "codepipeline.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: "codepipeline-service"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action: "*"
                Resource: "*"
  
  # Fetch code from Master branche, execute Lambda function to generate, compress and deploy static site.
  CodePipeline:
    Type: "AWS::CodePipeline::Pipeline"
    Properties:
      Name: !Sub "${DomainName}-codepipeline"
      ArtifactStore:
        Type: S3
        Location: !Ref ExistingCodePipelineBucket
      RestartExecutionOnUpdate: false
      RoleArn: !Sub "arn:aws:iam::${AWS::AccountId}:role/${CodePipelineRole}"
      Stages:
        - Name: Source
          Actions:
            - Name: SourceAction
              ActionTypeId:
                Category: Source
                Owner: AWS
                Provider: CodeCommit
                Version: 1
              Configuration:
                RepositoryName: !Ref ExistingGitRepository
                BranchName: master
              OutputArtifacts:
                - Name: SiteSource
              RunOrder: 1
        - Name: InvokeGenerator
          Actions:
            - Name: InvokeAction
              InputArtifacts:
                - Name: SiteSource
              ActionTypeId:
                Category: Invoke
                Owner: AWS
                Provider: Lambda
                Version: 1
              Configuration:
                FunctionName: !Ref GeneratorLambdaFunction
              OutputArtifacts:
                - Name: SiteContent
              RunOrder: 1

Outputs:
  CodePipelineArn:
    Description: CodePipeline ARN
    Value: !Ref CodePipeline
  CodePipelineS3Bucket:
    Description: CodePipeline S3 Bucket
    Value: !Ref ExistingCodePipelineBucket

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Website domain
        Parameters:
          - DomainName
      - Label:
          default: CodeCommit
        Parameters:
          - NotificationEmail
          - ExistingGitRepository
      - Label:
          default: AWS Lambda Static site generation function
        Parameters:
          - GeneratorLambdaFunctionS3Bucket
          - GeneratorLambdaFunctionS3Key
          - GeneratorLambdaFunctionRuntime
          - GeneratorLambdaFunctionHandler
      - Label:
          default: S3 site and code buckets
        Parameters:
          - ExistingSiteBucket
          - ExistingCodePipelineBucket