build-stack.yml

AWSTemplateFormatVersion: 2010-09-09

# Edit DomainName and CertificateArn here to move
# the project from subdomains on talusanalytics.com
# to a project-specific domain name.

# the project name is automatically pulled from the
# stack name given when invoking this template.

# command to run build-stack:
# aws --region us-east-1 cloudformation deploy --stack-name [projectname] --template-file build-stack.yml --capabilities CAPABILITY_NAMED_IAM
Parameters:
  DomainName:
    Type: String
    Default: 'ghssidea.org'
    # Default: "talusanalytics.com"
  CertificateArn:
    Type: String
    Default: 'arn:aws:acm:us-east-1:560812044035:certificate/32647416-bbb8-4860-9114-9ca1f773b0b8'
    # Default: "arn:aws:acm:us-east-1:560812044035:certificate/6e6a8e16-520e-4a15-bf4e-18cbd416be15"
    # Default: "arn:aws:acm:us-east-1:560812044035:certificate/de08d472-9d84-437b-b05b-6f3894be7dc5"
    # Default: 'arn:aws:acm:us-east-1:560812044035:certificate/d98e831c-999b-4d94-8d09-5b8922f2fcb8'

Conditions:
  # This conditional checks if the domain name is project-specific, or
  # if it is using talusanalytics.com; if talusanalytics.com is being
  # used, all the urls are built as subdomains with the branch name
  # hyphenated to the project name (pulled from the stack name):
  #     dev-project.talusanalytics.com
  #     review-project.talusanalytics.com
  #     staging-project.talusanalytics.com
  #     prod-project.talusanalytics.com

  # Once the project has a custom domain, this stack should be updated
  # with the correct domain and cert arn above, which will move all
  # associated resources to the standard project pattern:
  #     dev.projectdomain.com
  #     review.projectdomain.com
  #     staging.projectdomain.com
  #     projectdomain.com

  # Example update command (after editing domainName and cert above):
  # aws cloudformation update-stack \
  #   --stack-name build-stack-test \
  #   --template-body file://build-stack.yaml
  CustomDomainProvided: !Not [!Equals [!Ref DomainName, 'talusanalytics.com']]

Resources:
  # Using lambda to generate random string to use in headers between CF and S3
  # this locks down the s3 buckets so that their websites are only accessible
  # to cloudfront, so that they S3 website urls don't go around the lambda-at-edge
  # password checking on cloudfront requests

  # execution role for the lambda custom cloudfront resource
  RandomStringExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: allowLambdaLogging
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action:
                  - 'logs:*'
                Resource: '*'

  # lambda function to generate pseudo-random strings
  RandomStringLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: >
          const response = require("cfn-response");

          const randomString = (length) => {
              const chars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
              var result = '';
              for (var i = length; i > 0; --i) result += chars[Math.floor(Math.random() * chars.length)];
              return result;
          };

          exports.handler = (event, context) => {
            const str = randomString(event['ResourceProperties']['Length']);
            const responseData = {RandomString: str};
            response.send(event, context, response.SUCCESS, responseData);
          };
      Handler: index.handler
      Runtime: nodejs14.x
      Role: !GetAtt RandomStringExecutionRole.Arn
      MemorySize: 128
      Timeout: 20

  # the custom resource itself, this is what calls
  # the lambda once per create / update and makes
  # sure all of the resources below get the same
  # pseudo-random string.
  ProjectInternalHeaderString:
    Type: AWS::CloudFormation::CustomResource
    Properties:
      Length: 16
      ServiceToken: !GetAtt RandomStringLambdaFunction.Arn

  # Execution role for the basic auth lambda
  AuthLambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Principal:
              Service:
                - 'lambda.amazonaws.com'
                - 'edgelambda.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/CloudWatchLogsFullAccess'
      Policies:
        - PolicyName: allowLambdaLogging
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action:
                  - 'logs:*'
                Resource: '*'

  BasicAuthLambda:
    Type: 'AWS::Lambda::Function'
    Properties:
      FunctionName: !Join ['-', [!Ref AWS::StackName, 'basic-auth']]
      Role: !GetAtt AuthLambdaExecutionRole.Arn
      Runtime: nodejs14.x
      Handler: 'index.handler'
      MemorySize: 128
      Timeout: 5
      Code:
        ZipFile: >
          'use strict';
          exports.handler = (event, context, callback) => {

            const request = event.Records[0].cf.request;
            const headers = request.headers;

            const host = headers.host[0].value;
            const containsTerm = (term) => host.includes(term);
            let subdomain;
            if (host.includes('dev')) subdomain = 'dev';
            if (host.includes('review')) subdomain = 'review';
            if (host.includes('staging')) subdomain = 'staging';
            if (host.includes('prod')) subdomain = 'prod';

            const authObj = {
              dev: ['dev', ''],
              review: ['review', ''],
              staging: ['staging', ''],
              prod: ['prod', ''],
            };

            const checkAuthorized = headers => {
              if (typeof headers.authorization == 'undefined')
                return false;
              const authString = headers.authorization[0].value;
              const user = authObj[subdomain];
              const checkString = 'Basic ' +
                new Buffer(user[0] + ':' +
                user[1]).toString('base64');
              return authString === checkString;
            };

            if (!checkAuthorized(headers)) {
                const response = {
                    status: '401',
                    body: 'Unauthorized',
                    statusDescription: 'Unauthorized',
                    headers: {
                      'www-authenticate': [{
                        key: 'WWW-Authenticate',
                        value:'Basic',
                      }]
                    },
                };
                callback(null, response);
            };

          callback(null, request);
          };

  BasicAuthLambdaVersion:
    Type: 'AWS::Lambda::Version'
    Properties:
      Description: '1'
      FunctionName: !Ref BasicAuthLambda

  # ############ Dev site setup ############
  # S3DevBucket:
  #   Type: AWS::S3::Bucket
  #   Properties:
  #     BucketName: !Join ["-", ["dev", !Ref AWS::StackName]]
  #     WebsiteConfiguration:
  #       ErrorDocument: index.html
  #       IndexDocument: index.html

  # # the bucket hosts the website. This is
  # # not the standard way to connect S3 to
  # # cloudfront, but allows us to do redirects
  # # and pretty urls from S3, instead of needing
  # # a separate webserver. The StringEquals
  # # condition checks for the Referer header
  # # set by cloudfront so that this website
  # # can't be accessed except by cloudfront.
  # S3DevBucketPolicy:
  #   Type: AWS::S3::BucketPolicy
  #   Properties:
  #     Bucket: !Join ["-", ["dev", !Ref AWS::StackName]]
  #     PolicyDocument:
  #       Id: MyPolicy
  #       Version: 2012-10-17
  #       Statement:
  #         - Sid: PublicReadForGetBucketObjects
  #           Effect: Allow
  #           Principal: "*"
  #           Action: s3:GetObject
  #           Condition:
  #             StringEquals:
  #               "aws:Referer": !GetAtt ProjectInternalHeaderString.RandomString
  #           Resource:
  #             !Join ["", ["arn:aws:s3:::", "dev-", !Ref AWS::StackName, "/*"]]

  # # Fairly standard CF distribution, with the difference
  # # that the S3 bucket is added as a CustomOrigin pointed
  # # at the S3 website instead of as an S3 origin. The
  # # OriginCustomHeaders Referer header tells S3 that this
  # # is the correct cloudfront distribution to respond to.
  # DevDistribution:
  #   Type: "AWS::CloudFront::Distribution"
  #   Properties:
  #     DistributionConfig:
  #       Aliases:
  #         - !If [
  #             CustomDomainProvided,
  #             !Join [".", ["dev", !Ref DomainName]],
  #             !Join ["", ["dev-", !Ref AWS::StackName, ".", !Ref DomainName]],
  #           ]
  #       Origins:
  #         - DomainName:
  #             !Select [1, !Split ["//", !GetAtt S3DevBucket.WebsiteURL]]
  #           Id: myCustomOrigin
  #           CustomOriginConfig:
  #             HTTPPort: "80"
  #             HTTPSPort: "443"
  #             OriginProtocolPolicy: http-only
  #           OriginCustomHeaders:
  #             - HeaderName: "Referer"
  #               HeaderValue: !GetAtt ProjectInternalHeaderString.RandomString
  #       HttpVersion: http2
  #       Enabled: "true"
  #       DefaultRootObject: index.html
  #       DefaultCacheBehavior:
  #         AllowedMethods:
  #           - GET
  #           - HEAD
  #         CachedMethods:
  #           - GET
  #           - HEAD
  #         TargetOriginId: myCustomOrigin
  #         SmoothStreaming: "false"
  #         ForwardedValues:
  #           QueryString: "true"
  #         ViewerProtocolPolicy: redirect-to-https
  #         LambdaFunctionAssociations:
  #           - EventType: "viewer-request"
  #             LambdaFunctionARN: !Ref BasicAuthLambdaVersion
  #       PriceClass: PriceClass_100
  #       ViewerCertificate:
  #         AcmCertificateArn: !Ref CertificateArn
  #         MinimumProtocolVersion: TLSv1.2_2018
  #         SslSupportMethod: sni-only

  # # The Route53 A record pointing the subdomain to
  # # the cloudfront distribution
  # Route53DevRecord:
  #   Type: AWS::Route53::RecordSetGroup
  #   Properties:
  #     # HostedZoneName must include a trailing dot, this is so anoying
  #     # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-recordset.html#cfn-route53-recordset-hostedzonename
  #     HostedZoneName: !Join ["", [!Ref DomainName, "."]]
  #     RecordSets:
  #       - AliasTarget:
  #           DNSName: !GetAtt DevDistribution.DomainName
  #           HostedZoneId: Z2FDTNDATAQYW2
  #         Name:
  #           !If [
  #             CustomDomainProvided,
  #             !Join [".", ["dev", !Ref DomainName]],
  #             !Join ["", ["dev-", !Ref AWS::StackName, ".", !Ref DomainName]],
  #           ]
  #         Type: A

  # ########### Review site setup ############
  # # The following blocks follow the same pattern
  # # documented in the dev site setup.
  # S3ReviewBucket:
  #   Type: AWS::S3::Bucket
  #   Properties:
  #     BucketName: !Join ["-", ["review", !Ref AWS::StackName]]
  #     WebsiteConfiguration:
  #       ErrorDocument: index.html
  #       IndexDocument: index.html

  # S3ReviewBucketPolicy:
  #   Type: AWS::S3::BucketPolicy
  #   Properties:
  #     Bucket: !Join ["-", ["review", !Ref AWS::StackName]]
  #     PolicyDocument:
  #       Id: MyPolicy
  #       Version: 2012-10-17
  #       Statement:
  #         - Sid: PublicReadForGetBucketObjects
  #           Effect: Allow
  #           Principal: "*"
  #           Action: s3:GetObject
  #           Condition:
  #             StringEquals:
  #               "aws:Referer": !GetAtt ProjectInternalHeaderString.RandomString
  #           Resource:
  #             !Join [
  #               "",
  #               ["arn:aws:s3:::", "review-", !Ref AWS::StackName, "/*"],
  #             ]

  # ReviewDistribution:
  #   Type: "AWS::CloudFront::Distribution"
  #   Properties:
  #     DistributionConfig:
  #       Aliases:
  #         - !If [
  #             CustomDomainProvided,
  #             !Join [".", ["review", !Ref DomainName]],
  #             !Join [
  #               "",
  #               ["review-", !Ref AWS::StackName, ".", !Ref DomainName],
  #             ],
  #           ]
  #       Origins:
  #         - DomainName:
  #             !Select [1, !Split ["//", !GetAtt S3ReviewBucket.WebsiteURL]]
  #           Id: myCustomOrigin
  #           CustomOriginConfig:
  #             HTTPPort: "80"
  #             HTTPSPort: "443"
  #             OriginProtocolPolicy: http-only
  #           OriginCustomHeaders:
  #             - HeaderName: "Referer"
  #               HeaderValue: !GetAtt ProjectInternalHeaderString.RandomString
  #       HttpVersion: http2
  #       Enabled: "true"
  #       DefaultRootObject: index.html
  #       DefaultCacheBehavior:
  #         AllowedMethods:
  #           - GET
  #           - HEAD
  #         CachedMethods:
  #           - GET
  #           - HEAD
  #         TargetOriginId: myCustomOrigin
  #         SmoothStreaming: "false"
  #         ForwardedValues:
  #           QueryString: "true"
  #         ViewerProtocolPolicy: redirect-to-https
  #         LambdaFunctionAssociations:
  #           - EventType: "viewer-request"
  #             LambdaFunctionARN: !Ref BasicAuthLambdaVersion
  #       PriceClass: PriceClass_100
  #       ViewerCertificate:
  #         AcmCertificateArn: !Ref CertificateArn
  #         MinimumProtocolVersion: TLSv1.2_2018
  #         SslSupportMethod: sni-only

  # Route53ReviewRecord:
  #   Type: AWS::Route53::RecordSetGroup
  #   Properties:
  #     # HostedZoneName must include a trailing dot
  #     # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-recordset.html#cfn-route53-recordset-hostedzonename
  #     HostedZoneName: !Join ["", [!Ref DomainName, "."]]
  #     RecordSets:
  #       - AliasTarget:
  #           DNSName: !GetAtt ReviewDistribution.DomainName
  #           HostedZoneId: Z2FDTNDATAQYW2
  #         Name:
  #           !If [
  #             CustomDomainProvided,
  #             !Join [".", ["review", !Ref DomainName]],
  #             !Join [
  #               "",
  #               ["review-", !Ref AWS::StackName, ".", !Ref DomainName],
  #             ],
  #           ]
  #         Type: A

  ############ Staging site setup ############
  S3StagingBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join ['-', ['staging', !Ref AWS::StackName]]
      WebsiteConfiguration:
        ErrorDocument: index.html
        IndexDocument: index.html

  S3StagingBucketPolicy:
    Type: AWS::S3::BucketPolicy
    DependsOn: S3StagingBucket
    Properties:
      Bucket: !Join ['-', ['staging', !Ref AWS::StackName]]
      PolicyDocument:
        Id: MyPolicy
        Version: 2012-10-17
        Statement:
          - Sid: PublicReadForGetBucketObjects
            Effect: Allow
            Principal: '*'
            Action: s3:GetObject
            Condition:
              StringEquals:
                'aws:Referer': !GetAtt ProjectInternalHeaderString.RandomString
            Resource:
              !Join [
                '',
                ['arn:aws:s3:::', 'staging-', !Ref AWS::StackName, '/*'],
              ]

  StagingDistribution:
    Type: 'AWS::CloudFront::Distribution'
    Properties:
      DistributionConfig:
        Aliases:
          - !If [
              CustomDomainProvided,
              !Join ['.', ['staging', !Ref DomainName]],
              !Join [
                '',
                ['staging-', !Ref AWS::StackName, '.', !Ref DomainName],
              ],
            ]
        Origins:
          - DomainName:
              !Select [1, !Split ['//', !GetAtt S3StagingBucket.WebsiteURL]]
            Id: myCustomOrigin
            CustomOriginConfig:
              HTTPPort: '80'
              HTTPSPort: '443'
              OriginProtocolPolicy: http-only
            OriginCustomHeaders:
              - HeaderName: 'Referer'
                HeaderValue: !GetAtt ProjectInternalHeaderString.RandomString
        HttpVersion: http2
        Enabled: 'true'
        DefaultRootObject: index.html
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          TargetOriginId: myCustomOrigin
          SmoothStreaming: 'false'
          ForwardedValues:
            QueryString: 'true'
          ViewerProtocolPolicy: redirect-to-https
          LambdaFunctionAssociations:
            - EventType: 'viewer-request'
              LambdaFunctionARN: !Ref BasicAuthLambdaVersion
        PriceClass: PriceClass_100
        ViewerCertificate:
          AcmCertificateArn: !Ref CertificateArn
          MinimumProtocolVersion: TLSv1.2_2018
          SslSupportMethod: sni-only

  Route53StagingRecord:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      # HostedZoneName must include a trailing dot
      # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-recordset.html#cfn-route53-recordset-hostedzonename
      HostedZoneName: !Join ['', [!Ref DomainName, '.']]
      RecordSets:
        - AliasTarget:
            DNSName: !GetAtt StagingDistribution.DomainName
            HostedZoneId: Z2FDTNDATAQYW2
          Name:
            !If [
              CustomDomainProvided,
              !Join ['.', ['staging', !Ref DomainName]],
              !Join [
                '',
                ['staging-', !Ref AWS::StackName, '.', !Ref DomainName],
              ],
            ]
          Type: A

  # ############ Prod site setup ############
  # S3ProdBucket:
  #   Type: AWS::S3::Bucket
  #   Properties:
  #     BucketName: !Join ["-", ["prod", !Ref AWS::StackName]]
  #     WebsiteConfiguration:
  #       ErrorDocument: index.html
  #       IndexDocument: index.html

  # S3ProdBucketPolicy:
  #   Type: AWS::S3::BucketPolicy
  #   Properties:
  #     Bucket: !Join ["-", ["prod", !Ref AWS::StackName]]
  #     PolicyDocument:
  #       Id: MyPolicy
  #       Version: 2012-10-17
  #       Statement:
  #         - Sid: PublicReadForGetBucketObjects
  #           Effect: Allow
  #           Principal: "*"
  #           Action: s3:GetObject
  #           Condition:
  #             StringEquals:
  #               "aws:Referer": !GetAtt ProjectInternalHeaderString.RandomString
  #           Resource:
  #             !Join ["", ["arn:aws:s3:::", "prod-", !Ref AWS::StackName, "/*"]]

  # ProdDistribution:
  #   Type: "AWS::CloudFront::Distribution"
  #   Properties:
  #     DistributionConfig:
  #       Aliases:
  #         - !If [
  #             CustomDomainProvided,
  #             !Ref DomainName,
  #             !Join ["", ["prod-", !Ref AWS::StackName, ".", !Ref DomainName]],
  #           ]
  #       Origins:
  #         - DomainName:
  #             !Select [1, !Split ["//", !GetAtt S3ProdBucket.WebsiteURL]]
  #           Id: myCustomOrigin
  #           CustomOriginConfig:
  #             HTTPPort: "80"
  #             HTTPSPort: "443"
  #             OriginProtocolPolicy: http-only
  #           OriginCustomHeaders:
  #             - HeaderName: "Referer"
  #               HeaderValue: !GetAtt ProjectInternalHeaderString.RandomString
  #       HttpVersion: http2
  #       Enabled: "true"
  #       DefaultRootObject: index.html
  #       DefaultCacheBehavior:
  #         AllowedMethods:
  #           - GET
  #           - HEAD
  #         CachedMethods:
  #           - GET
  #           - HEAD
  #         TargetOriginId: myCustomOrigin
  #         SmoothStreaming: "false"
  #         ForwardedValues:
  #           QueryString: "true"
  #         ViewerProtocolPolicy: redirect-to-https
  #         LambdaFunctionAssociations:
  #           - EventType: "viewer-request"
  #             LambdaFunctionARN: !Ref BasicAuthLambdaVersion
  #       PriceClass: PriceClass_All
  #       ViewerCertificate:
  #         AcmCertificateArn: !Ref CertificateArn
  #         MinimumProtocolVersion: TLSv1.2_2018
  #         SslSupportMethod: sni-only

  # Route53ProdRecord:
  #   Type: AWS::Route53::RecordSetGroup
  #   Properties:
  #     # HostedZoneName must include a trailing dot
  #     # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-recordset.html#cfn-route53-recordset-hostedzonename
  #     HostedZoneName: !Join ["", [!Ref DomainName, "."]]
  #     RecordSets:
  #       - AliasTarget:
  #           DNSName: !GetAtt ProdDistribution.DomainName
  #           HostedZoneId: Z2FDTNDATAQYW2
  #         Name:
  #           !If [
  #             CustomDomainProvided,
  #             !Ref DomainName,
  #             !Join ["", ["prod-", !Ref AWS::StackName, ".", !Ref DomainName]],
  #           ]
  #         Type: A
# Outputs:
# CloudFrontID:
# Value: !Ref DevDistribution
# Description: Dev CloudFront ID
# CloudFrontURL:
# Value: !GetAtt DevDistribution.DomainName
# Description: CloudFront URL for updating DNS record