exodus-lambda-deploy.yaml

AWSTemplateFormatVersion: 2010-09-09

Transform: AWS::Serverless-2016-10-31

Description: Configuration for exodus-cdn Lambda@Edge deployment

Parameters:
  env:
    Type: String
    AllowedValues:
      - dev
      - stage
      - prod
    Default: dev
    Description: The environment for which resources are intended
  oai:
    Type: String
    Description: The origin access identity ID associated with the environment
  project:
    Type: String
    Default: exodus
    Description: The project name under which resources are created
  lambdafunctionrole:
    Type: String
    Default: None
    Description: The IAM Role ARN for Lambda Function resource
  keyids:
    Type: CommaDelimitedList
    Default: None
    Description: A list of secret key IDs for Distribution key groups

Conditions:
  EnableKeyGroup:
    !Not [!Equals [!Join ["", !Ref keyids], None]]

Resources:
  KeyGroup:
    Type: AWS::CloudFront::KeyGroup
    Condition: EnableKeyGroup
    Properties:
      KeyGroupConfig:
        Name: !Sub ${project}-cdn-${env}
        Comment: !Sub Signed URLs and cookies for ${project}-cdn-${env}
        Items: !Ref keyids

  CachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        DefaultTTL: 86400
        MaxTTL: 31536000
        MinTTL: 0
        Name: !Sub ${project}-cache-policy-${env}
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: whitelist
            Cookies:
              - CloudFront-Key-Pair-Id
              - CloudFront-Policy
              - CloudFront-Signature
          EnableAcceptEncodingGzip: false
          HeadersConfig:
            HeaderBehavior: whitelist
            Headers:
              - Want-Digest
              - X-Exodus-Query
          QueryStringsConfig:
            QueryStringBehavior: none

  Distribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Comment: !Sub ${project}-cdn-${env}
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          CachePolicyId: !Ref CachePolicy
          LambdaFunctionAssociations:
            - EventType: origin-request
              LambdaFunctionARN: !Ref OriginRequestFunc.Version
            - EventType: origin-response
              LambdaFunctionARN: !Ref OriginResponseFunc.Version
          TargetOriginId: !Sub S3-${project}-cdn-${env}
          TrustedKeyGroups:
            - !If
              - EnableKeyGroup
              - !Ref KeyGroup
              - !Ref AWS::NoValue
          ViewerProtocolPolicy: redirect-to-https
        Enabled: true
        HttpVersion: http2
        Origins:
          - DomainName: !Sub "${project}-cdn-${env}.s3.amazonaws.com"
            Id: !Sub "S3-${project}-cdn-${env}"
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${oai}"

  OriginRequestFunc:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${project}-origin-request-${env}
      CodeUri:
      Handler: exodus_lambda.origin_request
      Role: !Sub ${lambdafunctionrole}
      Runtime: python3.9
      Timeout: 5
      AutoPublishAlias: live

  OriginResponseFunc:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${project}-origin-response-${env}
      CodeUri:
      Handler: exodus_lambda.origin_response
      Role: !Sub ${lambdafunctionrole}
      Runtime: python3.9
      Timeout: 5
      AutoPublishAlias: live

Outputs:
  Distribution:
    Description: distribution domain name
    Value: !GetAtt Distribution.DomainName

  OriginRequestFunc:
    Description: origin-request function ARN with version
    Value: !Ref OriginRequestFunc.Version

  OriginResponseFunc:
    Description: origin-response function ARN with version
    Value: !Ref OriginResponseFunc.Version