cloudformation-template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Demonstration of Web Content Delivery on Amazon Web Services

Parameters:
  EC2LinuxImageId:
    Description: Linux Amazon Machine Image Id
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-arm64-gp2

Resources:
  VPC:
    Type: AWS::EC2::VPC
    DependsOn: CloudFrontPrefixListCustom
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: Demo VPC
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: Demo Internet Gateway
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone:
        Fn::Select:
          - 0
          - Fn::GetAZs: ""
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: Demo Public Subnet 1
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      MapPublicIpOnLaunch: false
      AvailabilityZone:
        Fn::Select:
          - 0
          - Fn::GetAZs: ""
      Tags:
        - Key: Name
          Value: Demo Private Subnet 1
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.3.0/24
      AvailabilityZone:
        Fn::Select:
          - 1
          - Fn::GetAZs: ""
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: Demo Public Subnet 2
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.4.0/24
      AvailabilityZone:
        Fn::Select:
          - 1
          - Fn::GetAZs: ""
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: Demo Private Subnet 2
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  PublicSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.5.0/24
      AvailabilityZone:
        Fn::Select:
          - 2
          - Fn::GetAZs: ""
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: Demo Public Subnet 3
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  PrivateSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.6.0/24
      AvailabilityZone:
        Fn::Select:
          - 2
          - Fn::GetAZs: ""
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: Demo Private Subnet 3
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: Demo Public Route Table
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  PublicRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnetAssociation1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRouteTable

  PublicSubnetAssociation2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRouteTable

  PublicSubnetAssociation3:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet3
      RouteTableId: !Ref PublicRouteTable

  EIP1:
   DependsOn: VPCGatewayAttachment
   Type: AWS::EC2::EIP
   Properties:
      Domain: vpc

  NATGateway1:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId:
        Fn::GetAtt:
        - EIP1
        - AllocationId
      SubnetId:
        Ref: PublicSubnet1
      Tags:
        - Key: Name
          Value: Demo NAT Gateway
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  PrivateRouteTable1:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: Demo Private Route Table 1
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  PrivateRouteTable2:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: Demo Private Route Table 2
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  PrivateRouteTable3:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: Demo Private Route Table 3
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  PrivateSubnetAssociation1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet1
      RouteTableId: !Ref PrivateRouteTable1

  PrivateSubnetAssociation2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet2
      RouteTableId: !Ref PrivateRouteTable2

  PrivateSubnetAssociation3:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet3
      RouteTableId: !Ref PrivateRouteTable3

  PrivateRoute1:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NATGateway1

  PrivateRoute2:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NATGateway1

  PrivateRoute3:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable3
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NATGateway1

  ELBApplicationLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: internet-facing
      Type: "application"
      Subnets:
        - !Ref PublicSubnet1
        - !Ref PublicSubnet2
        - !Ref PublicSubnet3
      SecurityGroups:
        - !GetAtt ELBSecurityGroup.GroupId
      LoadBalancerAttributes:
        - Key: routing.http.drop_invalid_header_fields.enabled
          Value: true
      Tags:
        - Key: Name
          Value: Demo Application Load Balancer
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  ELBTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckEnabled: true
      HealthCheckPath: "/api"
      Port: 80
      Protocol: HTTP
      HealthCheckPort: "traffic-port"
      HealthCheckProtocol: "HTTP"
      HealthCheckIntervalSeconds: 30
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 2
      TargetType: "instance"
      Matcher:
        HttpCode: '200'
      VpcId: !Ref VPC
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 30

  ELBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    DependsOn:
      - ELBApplicationLoadBalancer
      - ELBTargetGroup
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref ELBTargetGroup
      LoadBalancerArn: !Ref ELBApplicationLoadBalancer
      Port: 80
      Protocol: HTTP

  ELBListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    DependsOn:
      - ELBListener
      - ELBTargetGroup
    Properties:
      Actions:
        - Type: forward
          TargetGroupArn: !Ref ELBTargetGroup
      Conditions:
        - Field: path-pattern
          Values:
          - "/*"
      ListenerArn: !Ref ELBListener
      Priority: 1

  ELBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Demo EC2 Security Group
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourcePrefixListId: !GetAtt CloudFrontPrefixListCustom.PrefixListId
      Tags:
        - Key: Name
          Value: Demo ELB Security Group
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  EC2AutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    DependsOn: EC2LaunchTemplate
    Properties:
      VPCZoneIdentifier:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
        - !Ref PrivateSubnet3
      LaunchTemplate:
        LaunchTemplateId: !Ref EC2LaunchTemplate
        Version: !GetAtt EC2LaunchTemplate.LatestVersionNumber
      MaxSize: '9'
      MinSize: '3'
      DesiredCapacity: '3'
      TargetGroupARNs:
        - !Ref ELBTargetGroup
      HealthCheckType: ELB
      HealthCheckGracePeriod: 60
      Tags:
        - Key: Name
          Value: Demo EC2 Auto Scaling Group
          PropagateAtLaunch: "false"
        - Key: StackName
          Value: !Sub ${AWS::StackName}
          PropagateAtLaunch: "false"
        - Key: StackId
          Value: !Sub ${AWS::StackId}
          PropagateAtLaunch: "false"

  EC2AutoScalingScalingPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      PolicyType: TargetTrackingScaling
      AutoScalingGroupName: !Ref EC2AutoScalingGroup
      EstimatedInstanceWarmup: 300
      TargetTrackingConfiguration:
        PredefinedMetricSpecification:
          PredefinedMetricType: ASGAverageCPUUtilization
        TargetValue: 70

  EC2LaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        ImageId: !Ref EC2LinuxImageId
        InstanceType: m6g.large
        IamInstanceProfile:
          Name: !Ref EC2InstanceProfile
        SecurityGroupIds:
          - !GetAtt EC2SecurityGroup.GroupId
        TagSpecifications:
          - ResourceType: instance
            Tags:
              - Key: Name
                Value: Demo EC2 Instance
              - Key: StackName
                Value: !Sub ${AWS::StackName}
              - Key: StackId
                Value: !Sub ${AWS::StackId}
        UserData:
          Fn::Base64:
            !Sub |
              #!/bin/bash

              yum update -y
              curl -sL https://rpm.nodesource.com/setup_14.x | sudo bash -
              yum install -y nodejs

              # https://www.digitalocean.com/community/tutorials/how-to-set-up-a-node-js-application-for-production-on-centos-7
              npm install pm2@latest -g

              npm install express --save

              cat <<'EOF' >> app.js
              let express = require('express');
              let app = express();

              app.get('/api', (req, res) => {
                console.log(JSON.stringify(req.headers));
                let message = {
                  timestamp: new Date().toISOString(),
                  headers: req.headers,
                };
                res.json(message);
              });

              app.listen(80, () => {
                console.log('api is up!');
              });
              EOF

              sudo pm2 start ./app.js
              sudo pm2 startup systemd
              sudo pm2 save
              systemctl enable --now pm2-root.service

  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Demo EC2 Security Group
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - Description: Allow HTTP
          IpProtocol: "tcp"
          FromPort: "80"
          ToPort: "80"
          CidrIp: "10.0.0.0/16"
      Tags:
        - Key: Name
          Value: Demo EC2 Security Group
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  EC2InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: [ec2.amazonaws.com]
            Action: ['sts:AssumeRole']
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Tags:
        - Key: Name
          Value: Demo EC2 Instance IAM Role
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref EC2InstanceRole

  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: 'cloudfront.amazonaws.com'
            Action: s3:GetObject
            Resource: !Join ['', ['arn:aws:s3:::', !Ref 'S3Bucket', /*]]
            Condition:
              StringEquals:
                AWS:SourceArn: !Sub 'arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}'

  OriginAccessControl:
    Type: AWS::CloudFront::OriginAccessControl
    Properties:
      OriginAccessControlConfig:
        Description: 'Demo CloudFront Origin Access Control'
        Name: !Sub ${AWS::StackName}-DemoOAC
        OriginAccessControlOriginType: 's3'
        SigningBehavior: 'always'
        SigningProtocol: 'sigv4'

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Comment: 'Demo CloudFront Distribution'
        Origins:
          - DomainName: !GetAtt S3Bucket.RegionalDomainName
            Id: S3BucketOrigin
            S3OriginConfig:
              OriginAccessIdentity: ''
            OriginAccessControlId: !GetAtt OriginAccessControl.Id
          - DomainName: !GetAtt 'ELBApplicationLoadBalancer.DNSName'
            Id: ELBApplicationLoadBalancerOrigin
            CustomOriginConfig:
              HTTPPort: '80'
              OriginProtocolPolicy: 'http-only'
        Enabled: 'true'
        HttpVersion: http2
        DefaultRootObject: index.html
        DefaultCacheBehavior:
          Compress: 'true'
          AllowedMethods:
            - GET
            - HEAD
          TargetOriginId: S3BucketOrigin
          CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6 # managed cache policy id for CachingOptimized
          ForwardedValues:
            QueryString: 'false'
            Cookies:
              Forward: none
          ViewerProtocolPolicy: redirect-to-https
        CacheBehaviors:
          - TargetOriginId: ELBApplicationLoadBalancerOrigin
            Compress: 'true'
            PathPattern: '/api'
            ViewerProtocolPolicy: redirect-to-https
            AllowedMethods:
              - GET
              - HEAD
            CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad # managed cache policy id for CachingDisabled
            OriginRequestPolicyId: 216adef6-5c7f-47e4-b989-5492eafa07d3 # managed origin request policy id for AllViewer
        CustomErrorResponses:
          - ErrorCode: '403'
            ResponsePagePath: "/error.html"
            ResponseCode: '200'
            ErrorCachingMinTTL: '60'
          - ErrorCode: '404'
            ResponsePagePath: "/error.html"
            ResponseCode: '200'
            ErrorCachingMinTTL: '60'
          - ErrorCode: '503'
            ResponsePagePath: "/error.html"
            ResponseCode: '200'
            ErrorCachingMinTTL: '5'
          - ErrorCode: '504'
            ResponsePagePath: "/error.html"
            ResponseCode: '200'
            ErrorCachingMinTTL: '5'
      Tags:
        - Key: Name
          Value: Demo CloudFront Distribution
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  CloudFrontPrefixListCustom:
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt CloudFrontPrefixListLambdaFunction.Arn

  CloudFrontPrefixListLambdaPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - ec2:DescribeManagedPrefixLists
            Resource: '*'

  CloudFrontPrefixListLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - !Ref 'CloudFrontPrefixListLambdaPolicy'
      Tags:
        - Key: Name
          Value: Demo CloudFront Prefix List Lambda Role
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

  CloudFrontPrefixListLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: Get CloudFront managed prefix list Id
      Handler: index.lambda_handler
      Runtime: python3.9
      Role: !GetAtt 'CloudFrontPrefixListLambdaRole.Arn'
      Timeout: 10
      Code:
        ZipFile: |
          from __future__ import print_function
          import json
          import boto3
          import urllib3

          SUCCESS = 'SUCCESS'
          FAILED = 'FAILED'
          http = urllib3.PoolManager()

          # lambda handler of custom resource
          def lambda_handler(event, context):
              print('lambda_handler() received event: ' + json.dumps(event))
              status = FAILED
              data = {}
              try:
                  if event['RequestType'] == 'Create' or event['RequestType'] == 'Update':
                      data = get_cloudfront_managed_prefix_list_id()
                      status = SUCCESS
                  elif event['RequestType'] == 'Delete':
                      print('deletion of CloudFormation stack has no impact on CloudFront managed prefix list')
                      status = SUCCESS
              except Exception as e:
                  print('lambda_handler error: ' + str(e))
                  status = FAILED
              send(event, context, status, data)
              return

          def get_cloudfront_managed_prefix_list_id():
              response = boto3.client('ec2').describe_managed_prefix_lists(
                  Filters=[
                      {
                          'Name': 'prefix-list-name',
                          'Values': ['com.amazonaws.global.cloudfront.origin-facing']
                      }
                  ]
              )
              print("describe_managed_prefix_lists() returned response:")
              print(str(response))
              return response['PrefixLists'][0]

          def send(event, context, responseStatus, responseData, physicalResourceId=None, noEcho=False, reason=None):
              responseUrl = event['ResponseURL']
              print('responseUrl: ' + responseUrl)
              responseBody = {
                  'Status' : responseStatus,
                  'Reason' : reason or "See the details in CloudWatch Log Stream: {}".format(context.log_stream_name),
                  'PhysicalResourceId' : physicalResourceId or context.log_stream_name,
                  'StackId' : event['StackId'],
                  'RequestId' : event['RequestId'],
                  'LogicalResourceId' : event['LogicalResourceId'],
                  'NoEcho' : noEcho,
                  'Data' : responseData
              }
              json_responseBody = json.dumps(responseBody)
              print("Response body:")
              print(json_responseBody)
              headers = {
                  'content-type' : '',
                  'content-length' : str(len(json_responseBody))
              }
              try:
                  response = http.request('PUT', responseUrl, headers=headers, body=json_responseBody)
                  print("Status code:", response.status)
              except Exception as e:
                  print("send(..) failed executing http.request(..):", e)
      Tags:
        - Key: Name
          Value: Demo CloudFront Prefix List Lambda Function
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: StackId
          Value: !Sub ${AWS::StackId}

Outputs:
  CloudFrontConsole:
    Value: !Sub 'https://console.aws.amazon.com/cloudfront/v3/home?region=${AWS::Region}#/distributions/${CloudFrontDistribution}'
    Description: CloudFront Console
  CloudFrontStaticContentURL:
    Value: !Sub '${CloudFrontDistribution.DomainName}/index.html'
    Description: CloudFront static content URL
  CloudFrontDynamicContentURL:
    Value: !Sub '${CloudFrontDistribution.DomainName}/api'
    Description: CloudFront dynamic content URL
  CloudWatchConsole:
    Value: !Sub 'console.aws.amazon.com/cloudwatch/home?region=us-east-1#home:dashboards/CloudFront'
    Description: CloudWatch Dashboard Console for CloudFront in us-east-1 region
  ElasticLoadBalancerDomainName:
    Value: !GetAtt ELBApplicationLoadBalancer.DNSName
    Description: Dynamic content domain name (ALB origin restricted!)
  S3BucketDomainName:
    Value: !GetAtt S3Bucket.RegionalDomainName
    Description: Static content domain name (S3 origin restricted!)
  S3Console:
    Value: !Sub 'https://console.aws.amazon.com/s3/buckets/${S3Bucket}?region=${AWS::Region}'
    Description: S3 Console
  EC2Console:
    Value: !Sub 'https://console.aws.amazon.com/ec2/v2/home?region=${AWS::Region}#Instances:instanceState=running'
    Description: EC2 Console