cloudformation.yaml

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  BucketName:
    Type: String
  WebsiteCertificateARN:
    Type: String
Resources:
  WebsiteBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName:
        Ref: BucketName
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: 404.html
  WebsiteBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: WebsiteBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Action: "s3:GetObject"
          Effect: Allow
          Principal: "*"
          Resource:
            Fn::Sub: "arn:aws:s3:::${WebsiteBucket}/*"
  WebsiteDistribution:
    Type: AWS::CloudFront::Distribution
    DependsOn: WebsiteBucket
    Properties:
      DistributionConfig:
        Aliases:
        - job.ivelum.com
        CustomErrorResponses:
          - ErrorCode: 403
            ResponseCode: 404
            ResponsePagePath: /404.html
        Origins:
        - DomainName:
            Ref: WebsiteBucket
          Id:
            Ref: WebsiteBucket
          CustomOriginConfig:
            HTTPPort: 80
            HTTPSPort: 443
            OriginProtocolPolicy: 'http-only'
        Enabled: 'true'
        DefaultRootObject: index.html
        DefaultCacheBehavior:
          TargetOriginId:
            Ref: WebsiteBucket
          ViewerProtocolPolicy: 'redirect-to-https'
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachedMethods:
            - GET
            - HEAD
            - OPTIONS
          Compress: true
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
            Headers:
            - Access-Control-Request-Headers
            - Access-Control-Request-Method
            - Origin
        ViewerCertificate:
          AcmCertificateArn:
            Ref: WebsiteCertificateARN
          MinimumProtocolVersion: TLSv1.2_2018
          SslSupportMethod: sni-only
  DeployUser:
    Type: AWS::IAM::User
    Properties:
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
              - s3:ListBucket
            Effect: Allow
            Resource:
              Fn::Sub: "arn:aws:s3:::${WebsiteBucket}"
          - Action:
              - s3:*Object*
            Effect: Allow
            Resource:
              Fn::Sub: "arn:aws:s3:::${WebsiteBucket}/*"
          - Action:
              - cloudfront:CreateInvalidation
            Effect: Allow
            Resource: "*"
          - Action:
              - lambda:GetFunction
              - lambda:UpdateFunctionCode
              - lambda:UpdateFunctionConfiguration
            Effect: Allow
            Resource: !GetAtt JobApplicationLambda.Arn
        PolicyName: manage-static-website
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
  JobApplicationLambda:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler: "lambda_function.lambda_handler"
      Role: !GetAtt LambdaExecutionRole.Arn
      Code:
        # use CF feature - it compares yaml config with its previous version
        # without looking at the actual state of the lambda function
        # this way we can update code, deps and env vars during deploy
        ZipFile: import this
      Runtime: "python3.9"
      Timeout: 10
  JobApplicationAPI:
    Type: AWS::ApiGatewayV2::Api
    Properties:
      Description: Job Application HTTP API
      Name: job-application-lambda-api
      ProtocolType: HTTP
      Target: !GetAtt JobApplicationLambda.Arn
      CorsConfiguration:
        AllowOrigins: ["https://job.ivelum.com"]
        AllowMethods: ["GET", "HEAD", "OPTIONS", "POST"]
        AllowHeaders: ["*"]
  JobApplicationAPIInvokeLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref JobApplicationLambda
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${JobApplicationAPI}/$default/$default

Outputs:
  JobApplicationInvokeURL:
    Value: !Sub https://${JobApplicationAPI}.execute-api.${AWS::Region}.amazonaws.com