primary-region-infra.yml

AWSTemplateFormatVersion: '2010-09-09'

Parameters:
  StandbyReplBucketArn:
    Type: String
    Description: This is the bucket arn in the standby region
  ACMCertArn:
    Type: String
    Description: This is the ACM arn
  SiteURL:
    Type: String
    Description: This is the URL of the site
  ZoneName:
    Type: String
    Description: This is the ZoneName of the SiteURL
  USEast1Bucket:
    Type: String
    Description: This is the us-east-1 artifact bucket

Outputs:
  PrimaryHealthCheckId:
    Description: "Physical ID of healthcheck"
    Value: !Ref PrimaryHealthCheck
  PrimaryS3BucketArn:
    Description: "Full S3 Bucket Arn"
    Value: !Join [ "", [ 'arn:aws:s3:::' , !Ref PrimaryBucket ] ]
  PrimaryS3BucketName:
    Description: "S3 Bucket Name"
    Value: !Ref PrimaryBucket
  CloudFrontDistributionDomainName:
    Description: Domain Name
    Value: !GetAtt PrimaryCloudFrontDistribution.DomainName
  CloudFrontDistributionID:
    Description: CF ID
    Value: !Ref PrimaryCloudFrontDistribution
  Route53StackName:
    Description: Nested Stack Name
    Value: !GetAtt Route53Stack.Outputs.StackName

Resources:
  # Create a bucket
  PrimaryBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      VersioningConfiguration:
        Status: Enabled
      ReplicationConfiguration:
        Role: !GetAtt StaticS3ReplRole.Arn
        Rules:
          - Id: ReplAll
            Status: Enabled
            Prefix: ""
            Destination:
              Bucket: !Ref StandbyReplBucketArn
      WebsiteConfiguration:
        IndexDocument: "index.html"
  # Role for the bucket
  StaticS3ReplRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: ['sts:AssumeRole']
          Effect: Allow
          Principal:
            Service: [s3.amazonaws.com]
  # Policy for the role
  BucketBackupPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action: ['s3:GetReplicationConfiguration', 's3:ListBucket']
          Effect: Allow
          Resource:
          - !Join ['', ['arn:aws:s3:::', !Ref 'PrimaryBucket']]
        - Action: ['s3:GetObjectVersion', 's3:GetObjectVersionAcl']
          Effect: Allow
          Resource:
          - !Join ['', ['arn:aws:s3:::', !Ref 'PrimaryBucket', /*]]
        - Action: ['s3:ReplicateObject', 's3:ReplicateDelete']
          Effect: Allow
          Resource:
          - !Join ['', [ !Ref StandbyReplBucketArn, /* ] ]
      PolicyName: BucketBackupPolicy
      Roles: [ !Ref 'StaticS3ReplRole' ]

  PrimaryHealthCheck:
    Type: "AWS::Route53::HealthCheck"
    Properties:
      HealthCheckConfig:
        FullyQualifiedDomainName: !Join [ '.', [ !Join [ '-', [ "s3", !Ref "AWS::Region" ] ], "amazonaws.com" ] ]
        Type: "HTTP"
        ResourcePath: !Join [ '/', [ '', !Ref 'PrimaryBucket', 'index.html' ] ]
        FailureThreshold: 1
      HealthCheckTags:
        - Key: "Name"
          Value: !Sub "PrimaryBucket - ${SiteURL}"

  PrimaryCloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Aliases:
          - !Ref SiteURL
        Comment: PrimaryCloudFrontDistribution
        DefaultCacheBehavior:
          ForwardedValues:
            QueryString: false
          TargetOriginId: PrimaryBucketOrigin
          ViewerProtocolPolicy: redirect-to-https
        DefaultRootObject: index.html
        Enabled: 'true'
        HttpVersion: http2
        Origins:
          # Use the WebsiteURL /but/ use the part after '//'
        - DomainName: !Select [ "1" , "Fn::Split": [ "//", "Fn::GetAtt": [ PrimaryBucket, WebsiteURL ] ] ]
          Id: PrimaryBucketOrigin
          CustomOriginConfig:
            OriginProtocolPolicy: "http-only"
        PriceClass: PriceClass_100
        ViewerCertificate:
          AcmCertificateArn: !Ref ACMCertArn
          SslSupportMethod: sni-only
  Route53Stack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Join ['', [ "https://s3.amazonaws.com/", !Ref 'USEast1Bucket', '/nested-route53.yml' ] ]
      TimeoutInMinutes: 5
      Parameters:
        ZoneName: !Ref ZoneName
        SiteURL: !Ref SiteURL
        AliasTargetDNSName: !GetAtt PrimaryCloudFrontDistribution.DomainName