aws-static-site.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  Private S3 and CloudFront origin for nearmiss.chelseakr.com, including
  Route 53 DNS, an ACM certificate, and a least-privilege GitHub OIDC deploy role.

Parameters:
  DomainName:
    Type: String
    Default: nearmiss.chelseakr.com
    AllowedPattern: ^[a-z0-9.-]+$
  HostedZoneId:
    Type: AWS::Route53::HostedZone::Id
    Default: Z09063681IX9IVZF7L6YB
  SiteBucketName:
    Type: String
    Default: nearmiss.chelseakr.com
  GitHubRepository:
    Type: String
    Default: ChelseaKR/nearmiss
    AllowedPattern: ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$
  PublishDns:
    Type: String
    Default: "false"
    AllowedValues:
      - "true"
      - "false"

Conditions:
  PublishDnsRecords: !Equals [!Ref PublishDns, "true"]

Resources:
  SiteBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BucketName: !Ref SiteBucketName
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      LifecycleConfiguration:
        Rules:
          - Id: ExpireNoncurrentVersions
            Status: Enabled
            NoncurrentVersionExpiration:
              NoncurrentDays: 30
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled

  SiteCertificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref DomainName
      DomainValidationOptions:
        - DomainName: !Ref DomainName
          HostedZoneId: !Ref HostedZoneId
      ValidationMethod: DNS

  OriginAccessControl:
    Type: AWS::CloudFront::OriginAccessControl
    Properties:
      OriginAccessControlConfig:
        Description: !Sub "Private ${DomainName} S3 origin"
        Name: !Sub "${AWS::StackName}-oac"
        OriginAccessControlOriginType: s3
        SigningBehavior: always
        SigningProtocol: sigv4

  RouteRewriteFunction:
    Type: AWS::CloudFront::Function
    Properties:
      AutoPublish: true
      FunctionCode: |
        function handler(event) {
          var request = event.request;
          var uri = request.uri;
          if (uri.endsWith('/')) {
            request.uri += 'index.html';
          } else if (!uri.split('/').pop().includes('.')) {
            request.uri += '/index.html';
          }
          return request;
        }
      FunctionConfig:
        Comment: Resolve directory-style public routes to their reviewed index documents.
        Runtime: cloudfront-js-2.0
      Name: !Sub "${AWS::StackName}-route-rewrite"

  SiteResponseHeaders:
    Type: AWS::CloudFront::ResponseHeadersPolicy
    Properties:
      ResponseHeadersPolicyConfig:
        Comment: Security headers that preserve the intentionally embeddable hotspot widget.
        CustomHeadersConfig:
          Items:
            - Header: Cache-Control
              Override: true
              Value: public, max-age=0, must-revalidate
            - Header: Permissions-Policy
              Override: true
              Value: camera=(), geolocation=(self), microphone=(), payment=(), usb=()
        Name: !Sub "${AWS::StackName}-security-headers"
        SecurityHeadersConfig:
          ContentTypeOptions:
            Override: true
          ReferrerPolicy:
            Override: true
            ReferrerPolicy: strict-origin-when-cross-origin
          StrictTransportSecurity:
            AccessControlMaxAgeSec: 63072000
            IncludeSubdomains: true
            Override: true
            Preload: true

  SiteCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Comment: >-
          Cache public assets at the edge while keeping verifier query tokens distinct.
        DefaultTTL: 300
        MaxTTL: 86400
        MinTTL: 0
        Name: !Sub "${AWS::StackName}-public-cache"
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: none
          EnableAcceptEncodingBrotli: true
          EnableAcceptEncodingGzip: true
          HeadersConfig:
            HeaderBehavior: none
          QueryStringsConfig:
            QueryStringBehavior: whitelist
            QueryStrings:
              - verify

  SiteDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Aliases:
          - !Ref DomainName
        Comment: !Sub "Public NearMiss evidence site at ${DomainName}"
        CustomErrorResponses:
          - ErrorCachingMinTTL: 0
            ErrorCode: 403
            ResponseCode: 404
            ResponsePagePath: /404.html
          - ErrorCachingMinTTL: 0
            ErrorCode: 404
            ResponseCode: 404
            ResponsePagePath: /404.html
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachePolicyId: !Ref SiteCachePolicy
          CachedMethods:
            - GET
            - HEAD
            - OPTIONS
          Compress: true
          FunctionAssociations:
            - EventType: viewer-request
              FunctionARN: !GetAtt RouteRewriteFunction.FunctionMetadata.FunctionARN
          ResponseHeadersPolicyId: !Ref SiteResponseHeaders
          TargetOriginId: private-site-bucket
          ViewerProtocolPolicy: redirect-to-https
        DefaultRootObject: index.html
        Enabled: true
        HttpVersion: http2and3
        IPV6Enabled: true
        Origins:
          - DomainName: !GetAtt SiteBucket.RegionalDomainName
            Id: private-site-bucket
            OriginAccessControlId: !GetAtt OriginAccessControl.Id
            S3OriginConfig:
              OriginAccessIdentity: ""
        PriceClass: PriceClass_100
        ViewerCertificate:
          AcmCertificateArn: !Ref SiteCertificate
          MinimumProtocolVersion: TLSv1.2_2021
          SslSupportMethod: sni-only

  SiteBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref SiteBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowCloudFrontReadOnly
            Effect: Allow
            Principal:
              Service: cloudfront.amazonaws.com
            Action: s3:GetObject
            Resource: !Sub "${SiteBucket.Arn}/*"
            Condition:
              StringEquals:
                AWS:SourceArn: !Sub >-
                  arn:${AWS::Partition}:cloudfront::${AWS::AccountId}:distribution/${SiteDistribution}

  SiteDnsA:
    Type: AWS::Route53::RecordSet
    Condition: PublishDnsRecords
    Properties:
      AliasTarget:
        DNSName: !GetAtt SiteDistribution.DomainName
        EvaluateTargetHealth: false
        HostedZoneId: Z2FDTNDATAQYW2
      HostedZoneId: !Ref HostedZoneId
      Name: !Ref DomainName
      Type: A

  SiteDnsAAAA:
    Type: AWS::Route53::RecordSet
    Condition: PublishDnsRecords
    Properties:
      AliasTarget:
        DNSName: !GetAtt SiteDistribution.DomainName
        EvaluateTargetHealth: false
        HostedZoneId: Z2FDTNDATAQYW2
      HostedZoneId: !Ref HostedZoneId
      Name: !Ref DomainName
      Type: AAAA

  GitHubDeployRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Federated: !Sub >-
                arn:${AWS::Partition}:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com
            Action: sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                "token.actions.githubusercontent.com:aud": sts.amazonaws.com
                "token.actions.githubusercontent.com:sub": !Sub >-
                  repo:${GitHubRepository}:environment:production
      Description: Deploy the reviewed NearMiss static artifact from the production environment.
      Policies:
        - PolicyName: DeployNearMissStaticSite
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: ListSiteBucket
                Effect: Allow
                Action:
                  - s3:GetBucketLocation
                  - s3:ListBucket
                Resource: !GetAtt SiteBucket.Arn
              - Sid: PublishSiteObjects
                Effect: Allow
                Action:
                  - s3:DeleteObject
                  - s3:GetObject
                  - s3:PutObject
                Resource: !Sub "${SiteBucket.Arn}/*"
              - Sid: InvalidateSiteDistribution
                Effect: Allow
                Action:
                  - cloudfront:CreateInvalidation
                  - cloudfront:GetInvalidation
                Resource: !Sub >-
                  arn:${AWS::Partition}:cloudfront::${AWS::AccountId}:distribution/${SiteDistribution}
      RoleName: !Sub "${AWS::StackName}-github-deploy"

Outputs:
  CloudFrontDistributionId:
    Value: !Ref SiteDistribution
  CloudFrontDomainName:
    Value: !GetAtt SiteDistribution.DomainName
  DeploymentRoleArn:
    Value: !GetAtt GitHubDeployRole.Arn
  ProductionUrl:
    Value: !Sub "https://${DomainName}"
  SiteBucketName:
    Value: !Ref SiteBucket