AWS/CloudFormation

Quick Reference | AWS CLI | CloudFormation

Template Examples

S3 Bucket

Here is a CloudFormation Template (in yaml) that I used to create a S3 bucket with the following requirements:

• Public Read
• 7 day retention policy
• Bucket Policy allowing access to all resources.
• Export the S3 bucket name, Secure URL, and Website URL for usage in other templates.

AWS Template:

AWSTemplateFormatVersion: 2010-09-09

Parameters:
  BranchName:
    Description: Branch Name
    Type: String

Resources:

  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: PublicRead
      LifecycleConfiguration:
        Rules:
          - Status: Enabled
            ExpirationInDays: 7
      WebsiteConfiguration:
        IndexDocument: index.html
  
  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: S3Bucket
      PolicyDocument:
        Statement:
        - Sid: AddPerm
          Effect: 'Allow'
          Principal: '*'
          Action:
          - 's3:GetObject'
          Resource:
            Fn::Join:
            - ''
            - - 'arn:aws:s3:::'
              - Ref: 'S3Bucket'
              - '/**'

Outputs:
  S3BucketName:
    Value:
      Ref: S3Bucket
    Description: The S3 bucket name
    Export:
      Name:
        Fn::Sub: ${AWS::StackName}-S3BucketName

  S3BucketSecureURL:
    Value:
      Fn::Join: ['', ['http://', !GetAtt [S3Bucket, DomainName]]]
    Description: Name of S3 bucket to hold Tenant Management website content

  S3WebsiteURL:
    Description: Website URL of the S3 Bucket
    Value:  !Select [1, !Split ["//", !GetAtt S3Bucket.WebsiteURL]]
    Export: 
      Name: !Sub "${AWS::StackName}-S3WebsiteURL"

Lambda & CloudFront

Here is a CloudFormation Template (in yaml) that I used to create a 2 Lambda functions and a cloudfront distribution with the following requirements:

• use outputs from S3 bucket stack
• create lambda functions that will work with lambda edge.

• setup the needed IAM roles for lambda functions to execute on lambda edge.

• create cloudfront distribution that uses the lambda edge functions and configures the needed behaviors to use them.

AWS Template:

AWSTemplateFormatVersion: 2010-09-09

Parameters:
  BranchName:
    Description: Branch Name
    Type: String
  S3BucketStack:
    Description: S3 Bucket Stack Name
    Type: String
    Default: SYNC-s3-dev-ui-stack
  Entropy:
    Description: Random String
    Type: String

Resources:

  LambdaEdgeRoleRequest:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
            - edgelambda.amazonaws.com
          Action: sts:AssumeRole
      Path: "/service-role/"
      RoleName:
        Fn::Sub: 'LambaEdgeRoleRequest-${BranchName}-${Entropy}'
      Policies:
        - PolicyName: 
            Fn::Sub: 'AWSLambdaBasicExecutionRole-OriginRequest-${Entropy}'
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: "Allow"
                Action:
                  - "logs:CreateLogGroup"
                Resource: 
                  Fn::Sub: "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*"
              - Effect: "Allow"
                Action:
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource: 
                  Fn::Sub: "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/SyncUI-${BranchName}-OriginRequest-${Entropy}:*"

  LambdaFunctionRequest:
    Type: AWS::Lambda::Function
    DependsOn: LambdaEdgeRoleRequest
    DeletionPolicy: Retain
    Properties:
      Handler: "index.handler"
      Role:
        Fn::GetAtt: 
        - "LambdaEdgeRoleRequest"
        - "Arn"
      Runtime: "nodejs10.x"
      Code:
        S3Bucket: 
          Fn::ImportValue:
            !Sub ${S3BucketStack}-S3BucketName
        S3Key: !Sub "${BranchName}/OriginRequest.zip"
      FunctionName: 
        Fn::Sub: 'SyncUI-${BranchName}-OriginRequest-${Entropy}'
  
  LambdaFunctionRequestVersion:
    Type: AWS::Lambda::Version
    Properties:
      FunctionName: 
        Ref: "LambdaFunctionRequest"

  LambdaEdgeRoleResponse:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
            - edgelambda.amazonaws.com
          Action: sts:AssumeRole
      Path: "/service-role/"
      RoleName:
        Fn::Sub: 'LambaEdgeRoleResponse-${BranchName}-${Entropy}'
      Policies:
        - PolicyName: 
            Fn::Sub: 'AWSLambdaBasicExecutionRole-OriginResponse-${Entropy}'
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: "Allow"
                Action:
                  - "logs:CreateLogGroup"
                Resource: 
                  Fn::Sub: "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*"
              - Effect: "Allow"
                Action:
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource: 
                  Fn::Sub: "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/SyncUI-${BranchName}-OriginResponse-${Entropy}:*"

  LambdaFunctionResponse:
    Type: AWS::Lambda::Function
    DependsOn: LambdaEdgeRoleResponse
    DeletionPolicy: Retain
    Properties:
      Handler: "index.handler"
      Role:
        Fn::GetAtt: 
          - "LambdaEdgeRoleResponse"
          - "Arn"
      Runtime: "nodejs10.x"
      Code:
        S3Bucket: 
          Fn::ImportValue:
            !Sub ${S3BucketStack}-S3BucketName
        S3Key: !Sub "${BranchName}/OriginResponse.zip"
      FunctionName: 
        Fn::Sub: 'SyncUI-${BranchName}-OriginResponse-${Entropy}'  

  LambdaFunctionResponseVersion:
    Type: AWS::Lambda::Version
    Properties:
      FunctionName: 
        Ref: "LambdaFunctionResponse"

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    DependsOn: 
    - LambdaFunctionRequest 
    - LambdaFunctionResponse
    Properties:
      DistributionConfig:
        Enabled: 'true'
        Origins:
        - DomainName:
            Fn::ImportValue:
              !Sub "${S3BucketStack}-S3WebsiteURL"
          OriginPath:
            Fn::Sub: '/${BranchName}'
          CustomOriginConfig:
            OriginProtocolPolicy: match-viewer
          Id: !Sub "CFID-${BranchName}-${Entropy}"
        DefaultCacheBehavior:
          TargetOriginId: !Sub "CFID-${BranchName}-${Entropy}"
          ForwardedValues:
            QueryString: 'false'
          ViewerProtocolPolicy: allow-all
          LambdaFunctionAssociations:
          - EventType: origin-request
            LambdaFunctionARN: !Ref LambdaFunctionRequestVersion
          - EventType: origin-response
            LambdaFunctionARN: !Ref LambdaFunctionResponseVersion
              
        CacheBehaviors:
        - PathPattern:
            Fn::Sub: '/${BranchName}'
          ForwardedValues:
            QueryString: false
          TargetOriginId: !Sub "CFID-${BranchName}-${Entropy}"
          ViewerProtocolPolicy: allow-all
          LambdaFunctionAssociations:
          - EventType: origin-request
            LambdaFunctionARN: !Ref LambdaFunctionRequestVersion
          - EventType: origin-response
            LambdaFunctionARN: !Ref LambdaFunctionResponseVersion
        - PathPattern:
            Fn::Sub: '/${BranchName}/*'
          ForwardedValues:
            QueryString: false
          TargetOriginId: !Sub "CFID-${BranchName}-${Entropy}"
          ViewerProtocolPolicy: allow-all
          LambdaFunctionAssociations:
          - EventType: origin-request
            LambdaFunctionARN: !Ref LambdaFunctionRequestVersion
          - EventType: origin-response
            LambdaFunctionARN: !Ref LambdaFunctionResponseVersion