Merge pull request #10 from aws-samples/copy-function

Function to copy content into S3 bucket

Author: mohsanjaffery

.gitignore

@@ -9,10 +9,10 @@
 **/out-tsc
 **/settings.js
 **/packaged.template
-macro.zip
 packaged.template
 packaged.zip
 s-headers.zip
+witch.zip
 
 # dependencies
 **/node_modules

templates/acm-certificate.yaml

@@ -9,8 +9,15 @@ Parameters:
     Default: 'us-east-1'
   CFNCustomProvider:
     Type: String
+  CopyFunction:
+    Type: String
 
 Resources:
+  CopyCustomResource:
+    Type: "AWS::CloudFormation::CustomResource"
+    Properties:
+      ServiceToken: !Ref CopyFunction
+
   Certificate:
     Type: Custom::Certificate
     Properties:
@@ -47,6 +54,8 @@ Resources:
 
 Outputs:
   DNSRecord:
+    Description: DNS record
     Value: !Sub '${CertificateDNSRecord.Name} ${CertificateDNSRecord.Type} ${CertificateDNSRecord.Value}'
   CertificateArn: 
+    Description: Issued certificate
     Value: !Ref Certificate

templates/cloudfront-site.yaml

@@ -12,42 +12,23 @@ Parameters:
   SubDomain:
     Description: Subdomain
     Type: String
-  Release:
-    Description: Release Version
-    Type: String
-
-Resources:
   S3BucketLogs:
-    Type: AWS::S3::Bucket
-    DeletionPolicy: Retain
-    Properties:
-      AccessControl: LogDeliveryWrite
-      BucketEncryption:
-        ServerSideEncryptionConfiguration:
-          - ServerSideEncryptionByDefault:
-              SSEAlgorithm: AES256
-      Tags:
-        - Key: Solution
-          Value: ACFS3
-
+    Description: Logging Bucket
+    Type: String
   S3BucketRoot:
-    Type: AWS::S3::Bucket
-    DeletionPolicy: Retain
-    Properties:
-      BucketEncryption:
-        ServerSideEncryptionConfiguration:
-          - ServerSideEncryptionByDefault:
-              SSEAlgorithm: AES256
-      LoggingConfiguration:
-        DestinationBucketName: !Ref 'S3BucketLogs'
-        LogFilePrefix: 'cdn/'
-      WebsiteConfiguration:
-        ErrorDocument: '404.html'
-        IndexDocument: 'index.html'
-      Tags:
-        - Key: Domain
-          Value: !Sub '${SubDomain}.${DomainName}'
+    Description: Content Bucket
+    Type: String
+  S3BucketLogsName:
+    Description: Logging Bucket
+    Type: String
+  S3BucketRootName:
+    Description: Content Bucket
+    Type: String
+  S3BucketRootArn:
+    Description: Content Bucket locator
+    Type: String
 
+Resources:
   S3BucketPolicy:
     Type: AWS::S3::BucketPolicy
     Properties:
@@ -58,7 +39,7 @@ Resources:
           - Action:
               - s3:GetObject
             Effect: Allow
-            Resource: !Sub '${S3BucketRoot.Arn}/*'
+            Resource: !Sub '${S3BucketRootArn}/*'
             Principal:
               CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId
 
@@ -123,16 +104,20 @@ Resources:
             ErrorCode: 404
             ResponseCode: 404
             ResponsePagePath: '/404.html'
+          - ErrorCachingMinTTL: 60
+            ErrorCode: 403
+            ResponseCode: 403
+            ResponsePagePath: '/403.html'
         Enabled: true
         HttpVersion: 'http2'
         DefaultRootObject: 'index.html'
         IPV6Enabled: true
         Logging:
-          Bucket: !GetAtt 'S3BucketLogs.DomainName'
+          Bucket: !Ref 'S3BucketLogsName'
           IncludeCookies: false
           Prefix: 'cdn/'
         Origins:
-          - DomainName: !GetAtt 'S3BucketRoot.DomainName'
+          - DomainName: !Ref 'S3BucketRootName'
             Id: !Sub 'S3-${AWS::StackName}-root'
             S3OriginConfig:
               OriginAccessIdentity:
@@ -167,21 +152,13 @@ Resources:
 
 Outputs:
   LambdaEdgeFunctionVersion:
-    Description: Lambda@Edge Function ARN with Version
+    Description: Security Lambda version
     Value: !Ref Lambdaversion
 
   CloudFrontDistribution:
-    Description: Cloudfront Distribution Domain Name
+    Description: CloudFront distribution
     Value: !GetAtt CloudFrontDistribution.DomainName
 
   CloudFrontDomainName:
-    Description: Cloudfront Distribution CNAME
+    Description: Website address
     Value: !Sub '${SubDomain}.${DomainName}'
-
-  S3BucketLogs:
-    Description: Logging Bucket
-    Value: !Ref S3BucketLogs
-
-  S3BucketRoot:
-    Description: Webroot Bucket
-    Value: !Ref S3BucketRoot

templates/custom-resource.yaml

@@ -2,12 +2,6 @@ AWSTemplateFormatVersion: '2010-09-09'
 Description: ACFS3 - Cert Provider with DNS validation
 Transform: AWS::Serverless-2016-10-31
 
-Parameters:
-  LayerBucket:
-    Type: String
-  LayerVersion:
-    Type: String
-
 Resources:
   LambdaPermission:
     Type: AWS::Lambda::Permission
@@ -75,26 +69,40 @@ Resources:
       Role: !GetAtt LambdaRole.Arn
       Runtime: python3.6
 
-  CopyBucket:
+  S3BucketLogs:
+    Type: AWS::S3::Bucket
     DeletionPolicy: Retain
-    Type: "AWS::S3::Bucket"
     Properties:
-      WebsiteConfiguration:
-        ErrorDocument: error.html
-        IndexDocument: index.html
+      AccessControl: LogDeliveryWrite
       BucketEncryption:
         ServerSideEncryptionConfiguration:
           - ServerSideEncryptionByDefault:
               SSEAlgorithm: AES256
+      Tags:
+        - Key: Solution
+          Value: ACFS3
 
+  S3BucketRoot:
+    Type: AWS::S3::Bucket
+    DeletionPolicy: Retain
+    Properties:
+      BucketEncryption:
+        ServerSideEncryptionConfiguration:
+          - ServerSideEncryptionByDefault:
+              SSEAlgorithm: AES256
+      LoggingConfiguration:
+        DestinationBucketName: !Ref 'S3BucketLogs'
+        LogFilePrefix: 'cdn/'
+      Tags:
+        - Key: Solution
+          Value: ACFS3
+  
   CopyLayerVersion:
-    Type: "AWS::Lambda::LayerVersion"
+    Type: "AWS::Serverless::LayerVersion"
     Properties:
+      ContentUri: ../witch.zip
       CompatibleRuntimes:
         - nodejs12.x
-      Content:
-        S3Bucket: !Ref LayerBucket
-        S3Key: !Sub '${LayerVersion}/witch.zip'
 
   CopyRole:
     Type: "AWS::IAM::Role"
@@ -111,12 +119,12 @@ Resources:
         - arn:aws:iam::aws:policy/AmazonS3FullAccess
 
   CopyFunction:
-    Type: "AWS::Lambda::Function"
+    Type: AWS::Serverless::Function
     Properties:
-      Code: ../www
+      CodeUri: ../www
       Environment:
         Variables:
-          BUCKET: !Ref CopyBucket
+          BUCKET: !Ref S3BucketRoot
       Handler: witch.staticHandler
       Layers:
         - !Ref CopyLayerVersion
@@ -125,11 +133,24 @@ Resources:
       Timeout: 300
 
 Outputs:
+  S3BucketRoot:
+    Description: Website bucket
+    Value: !Ref S3BucketRoot
+  S3BucketRootName:
+    Description: Website bucket name
+    Value: !GetAtt S3BucketRoot.DomainName
+  S3BucketRootArn:
+    Description: Website bucket locator
+    Value: !GetAtt S3BucketRoot.Arn
+  S3BucketLogs:
+    Description: Logging bucket
+    Value: !Ref S3BucketLogs
+  S3BucketLogsName:
+    Description: Logging bucket Name
+    Value: !GetAtt S3BucketLogs.DomainName
   CFNCustomProvider:
+    Description: ACM helper function
     Value: !GetAtt CFNCustomProvider.Arn
-
-  CopyCustomResource:
-    Value: !GetAtt CopyCustomResource.Arn
-
-  CopyBucketWebsiteURL:
-    Value: !GetAtt CopyBucket.WebsiteURL
+  CopyFunction:
+    Description: S3 helper function
+    Value: !GetAtt CopyFunction.Arn

templates/main.yaml

@@ -16,9 +16,6 @@ Mappings:
       Version: 'v0.4'
 
 Parameters:
-  LayerBucket:
-    Description: Layer bucket
-    Type: String
   SubDomain:
     Description: The part of a website address before your DomainName - e.g. www or img
     Type: String
@@ -33,9 +30,6 @@ Resources:
     Type: AWS::CloudFormation::Stack
     Properties:
       TemplateURL: ./custom-resource.yaml
-      Parameters: 
-        LayerVersion: !FindInMap [Solution, Constants, Version]
-        LayerBucket: !Ref LayerBucket
       Tags:
         - Key: Solution
           Value: ACFS3
@@ -47,6 +41,7 @@ Resources:
       Parameters:
         DomainName: !Ref DomainName
         CFNCustomProvider: !GetAtt CustomResourceStack.Outputs.CFNCustomProvider
+        CopyFunction: !GetAtt CustomResourceStack.Outputs.CopyFunction
       Tags:
         - Key: Solution
           Value: ACFS3
@@ -59,28 +54,45 @@ Resources:
         CertificateArn: !GetAtt AcmCertificateStack.Outputs.CertificateArn
         DomainName: !Ref DomainName
         SubDomain: !Ref SubDomain
-        Release: !FindInMap [Solution, Constants, Version]
+        S3BucketRoot: !GetAtt CustomResourceStack.Outputs.S3BucketRoot
+        S3BucketRootName: !GetAtt CustomResourceStack.Outputs.S3BucketRootName
+        S3BucketRootArn: !GetAtt CustomResourceStack.Outputs.S3BucketRootArn
+        S3BucketLogs: !GetAtt CustomResourceStack.Outputs.S3BucketLogs
+        S3BucketLogsName: !GetAtt CustomResourceStack.Outputs.S3BucketLogsName
       Tags:
         - Key: Solution
           Value: ACFS3
 
 Outputs:
   CFNCustomProvider:
+    Description: ACM helper function    
     Value: !GetAtt CustomResourceStack.Outputs.CFNCustomProvider
+  CopyFunction:
+    Description: S3 helper function    
+    Value: !GetAtt CustomResourceStack.Outputs.CopyFunction
+  S3BucketLogs:
+    Description: Logging bucket
+    Value: !GetAtt CustomResourceStack.Outputs.S3BucketLogs
+  S3BucketRoot:
+    Description: Website bucket
+    Value: !GetAtt CustomResourceStack.Outputs.S3BucketRoot
+  S3BucketLogsName:
+    Description: Logging bucket name
+    Value: !GetAtt CustomResourceStack.Outputs.S3BucketLogsName
+  S3BucketRootName:
+    Description: Website bucket name
+    Value: !GetAtt CustomResourceStack.Outputs.S3BucketRootName
   CertificateArn:
+    Description: Issued certificate 
     Value: !GetAtt AcmCertificateStack.Outputs.CertificateArn
   CFDistributionName:
+    Description: CloudFront distribution
     Value: !GetAtt CloudFrontStack.Outputs.CloudFrontDistribution
   LambdaEdgeFunctionVersion:
+    Description: Security Lambda version
     Value: !GetAtt CloudFrontStack.Outputs.LambdaEdgeFunctionVersion
   CloudFrontDomainName:
-    Description: Cloudfront Distribution CNAME
+    Description: Website address
     Value: !GetAtt CloudFrontStack.Outputs.CloudFrontDomainName
-  S3BucketLogs:
-    Description: Logging Bucket
-    Value: !GetAtt CloudFrontStack.Outputs.S3BucketLogs
-  S3BucketRoot:
-    Description: Webroot Bucket
-    Value: !GetAtt CloudFrontStack.Outputs.S3BucketRoot
   SolutionVersion:
     Value: !FindInMap [Solution, Constants, Version]