privateWebsiteStackTemplate.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Identity Aware Proxy + S3 Private Website",
  "Transform": "AWS::Serverless-2016-10-31",
  "Parameters": {
    "accessTokenIssuer": {
      "Type": "String",
      "Description": "The authentication token issuer url used to verify incoming tokens. Get one by creating an account at https://authress.io",
      "Default": "acc-0001.login.authress.io"
    },
    "applicationIdentifier": {
      "Type": "String",
      "Description": "The application identifier used to securely log users in via the hosted login page. Use the default application or create on at: https://authress.io/app/#/settings?focus=applications",
      "Default": "app_default"
    },
    "bucketWebsiteS3Name": {
      "Type": "String",
      "Description": "Your S3 Bucket that contains your private static website. This is necessary to configure the CloudFront to proxy your S3 bucket."
    },
    "identityAwareProxyCustomName": {
      "Type": "String",
      "Description": "Provide a custom name of the proxy microservice, is used in the naming of various created resources.",
      "Default": "IdentityAwareProxy"
    },
    "identityAwareProxyVersion": {
      "Type": "String",
      "Description": "The version of the proxy to deploy. Released version numbers are listed: https://github.com/Authress/identity-aware-proxy/tags",
      "Default": "1.0"
    },
    "proxyCustomDomain": {
      "Type": "String",
      "Description": "[Optional] Specify a domain to host the proxy on. This is where your users will connect to, and will forward the requests to your bucket.",
      "Default": ""
    },
    "proxyRoute53HostedZoneId": {
      "Type": "String",
      "Description": "[Optional] Specify the Route53 hosted zone that will be used to connect your custom domain to the CloudFront. This will also be used to request a Certificate for that domain.",
      "Default": ""
    }
  },
  "Conditions": {
    "DeployCustomDomain": { "Fn::Not": [{ "Fn::Equals": [{ "Ref": "proxyCustomDomain" }, ""] }] }
  },

  "Resources": {
    "LambdaFunctionAutoVersion": {
      "Type": "AWS::Serverless::Function",
      "Properties": {
        "FunctionName": { "Ref": "identityAwareProxyCustomName" },
        "Description": "Identity Aware Proxy",
        "Handler": "index.handler",
        "Runtime": "nodejs18.x",

        "AutoPublishAlias": "production",
        "AutoPublishAliasAllProperties": true,
        "CodeUri": {
          "Bucket": "authress-identity-aware-proxy-public-artifacts",
          "Key": { "Fn::Sub": "IdentityAwareProxy/${identityAwareProxyVersion}/lambda.zip" }
        },
        "MemorySize": 1769,
        "Timeout": 30,
        "Role": { "Fn::GetAtt": ["LambdaRole", "Arn"] }
      }
    },
    "LambdaRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "RoleName": {
          "Fn::Sub": "${identityAwareProxyCustomName}LambdaRole-${AWS::Region}"
        },
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "lambda.amazonaws.com",
                  "edgelambda.amazonaws.com"
                ]
              },
              "Action": [
                "sts:AssumeRole"
              ]
            }
          ]
        },
        "ManagedPolicyArns": [
          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
          "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess"
        ],
        "Path": "/"
      }
    },
    "CloudFrontOriginAccessIdentity": {
      "Type": "AWS::CloudFront::CloudFrontOriginAccessIdentity",
      "Properties": {
        "CloudFrontOriginAccessIdentityConfig": {
          "Comment": "Identity Aware Proxy"
        }
      }
    },
    "S3BucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {
          "Ref": "bucketWebsiteS3Name"
        },
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "Grant a CloudFront Origin Identity access to support private content",
              "Effect": "Allow",
              "Principal": {
                "CanonicalUser": {
                  "Fn::GetAtt": [
                    "CloudFrontOriginAccessIdentity",
                    "S3CanonicalUserId"
                  ]
                }
              },
              "Action": "s3:GetObject",
              "Resource": {
                "Fn::Sub": "arn:aws:s3:::${bucketWebsiteS3Name}/*"
              }
            }
          ]
        }
      }
    },
    "HostVaryFrontCachingPolicy": {
      "Type": "AWS::CloudFront::CachePolicy",
      "Properties": {
        "CachePolicyConfig": {
          "Comment": "Authentication Login Vary response on Host",
          "DefaultTTL": 0,
          "MaxTTL": 864000,
          "MinTTL": 0,
          "Name": { "Fn::Sub": "${identityAwareProxyCustomName}-HostVaryFrontCachingPolicy" },
          "ParametersInCacheKeyAndForwardedToOrigin": {
            "CookiesConfig": {
              "CookieBehavior": "whitelist",
              "Cookies": ["authorization", "iap-redirectUrl", "iap-codeVerifier"]
            },
            "EnableAcceptEncodingBrotli": true,
            "EnableAcceptEncodingGzip": true,
            "HeadersConfig": {
              "HeaderBehavior": "whitelist",
              "Headers": ["Host", "Origin", "Sec-Fetch-Dest", "Sec-Fetch-Mode", "Sec-Fetch-Site"]
            },
            "QueryStringsConfig": {
              "QueryStringBehavior": "none"
            }
          }
        }
      }
    },
    "ProtectedRouteCachingPolicy": {
      "Type": "AWS::CloudFront::CachePolicy",
      "Properties": {
        "CachePolicyConfig": {
          "Comment": "Authentication Login Vary response on Host",
          "DefaultTTL": 86400,
          "MaxTTL": 864000,
          "MinTTL": 1,
          "Name": { "Fn::Sub": "${identityAwareProxyCustomName}-ProtectedRouteCachingPolicy" },
          "ParametersInCacheKeyAndForwardedToOrigin": {
            "CookiesConfig": {
              "CookieBehavior": "whitelist",
              "Cookies": ["authorization"]
            },
            "EnableAcceptEncodingBrotli": true,
            "EnableAcceptEncodingGzip": true,
            "HeadersConfig": {
              "HeaderBehavior": "whitelist",
              "Headers": ["Host", "Origin"]
            },
            "QueryStringsConfig": {
              "QueryStringBehavior": "none"
            }
          }
        }
      }
    },
    "LoginUIHostVaryFrontOriginRequestPolicy": {
      "Type": "AWS::CloudFront::OriginRequestPolicy",
      "Properties": {
        "OriginRequestPolicyConfig": {
          "Name": { "Fn::Sub": "${identityAwareProxyCustomName}-Login-UI" },
          "Comment": "Login UI send additional headers, cookies, and query to origin",
          "CookiesConfig": {
            "CookieBehavior": "all"
          },
          "HeadersConfig": {
            "HeaderBehavior": "allViewer"
          },
          "QueryStringsConfig": {
            "QueryStringBehavior": "all"
          }
        }
      }
    },
    "TLSCertificate": {
      "Type": "AWS::CertificateManager::Certificate",
      "Condition": "DeployCustomDomain",
      "DeletionPolicy": "Retain",
      "Properties": {
        "DomainName": { "Fn::Sub": "${proxyCustomDomain}" },
        "ValidationMethod": "DNS",
        "DomainValidationOptions": [{
          "DomainName": { "Fn::Sub": "${proxyCustomDomain}" },
          "HostedZoneId": { "Ref": "proxyRoute53HostedZoneId" }
        }]
      }
    },
    "CloudFrontDistribution": {
      "Type": "AWS::CloudFront::Distribution",
      "Properties": {
        "DistributionConfig": {
          "Comment": "Identity Aware Proxy",
          "Enabled": true,
          "DefaultRootObject": "index.html",
          "HttpVersion": "http2and3",
          "PriceClass": "PriceClass_All",
          "Aliases": { "Fn::If": ["DeployCustomDomain", [{ "Fn::Sub": "${proxyCustomDomain}" }], { "Ref": "AWS::NoValue" }] },
          "Origins": [
            {
              "DomainName": {
                "Fn::Sub": "${bucketWebsiteS3Name}.s3.amazonaws.com"
              },
              "Id": "S3",
              "OriginCustomHeaders": [
                { "HeaderName": "X-SERVICE-NAME", "HeaderValue": { "Ref": "identityAwareProxyCustomName" } },
                { "HeaderName": "X-ISSUER", "HeaderValue": { "Ref": "accessTokenIssuer" } },
                { "HeaderName": "X-AUTHRESS-APPLICATION-ID", "HeaderValue": { "Ref": "applicationIdentifier" } }
              ],
              "S3OriginConfig": {
                "OriginAccessIdentity": {
                  "Fn::Sub": "origin-access-identity/cloudfront/${CloudFrontOriginAccessIdentity}"
                }
              }
            }
          ],
          "CacheBehaviors": [
            {
              "PathPattern": "/favicon.ico",
              "AllowedMethods": ["GET", "HEAD", "OPTIONS"],
              "Compress": true,
              "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
              "OriginRequestPolicyId": "88a5eaf4-2fd4-4709-b370-b4c650ea3fcf",
              "ResponseHeadersPolicyId": "67f7725c-6f97-4210-82d7-5512b31e9d03",
              "TargetOriginId": "S3",
              "ViewerProtocolPolicy": "redirect-to-https"
            },
            {
              "PathPattern": "/",
              "AllowedMethods": ["GET", "HEAD", "OPTIONS"],
              "Compress": true,
              "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
              "OriginRequestPolicyId": "88a5eaf4-2fd4-4709-b370-b4c650ea3fcf",
              "ResponseHeadersPolicyId": "67f7725c-6f97-4210-82d7-5512b31e9d03",
              "TargetOriginId": "S3",
              "ViewerProtocolPolicy": "redirect-to-https"
            },
            {
              "PathPattern": "/index.html",
              "AllowedMethods": ["GET", "HEAD", "OPTIONS"],
              "Compress": true,
              "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
              "OriginRequestPolicyId": "88a5eaf4-2fd4-4709-b370-b4c650ea3fcf",
              "ResponseHeadersPolicyId": "67f7725c-6f97-4210-82d7-5512b31e9d03",
              "TargetOriginId": "S3",
              "ViewerProtocolPolicy": "redirect-to-https"
            },
            {
              "PathPattern": "public/*",
              "AllowedMethods": ["GET", "HEAD", "OPTIONS"],
              "Compress": true,
              "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
              "OriginRequestPolicyId": "88a5eaf4-2fd4-4709-b370-b4c650ea3fcf",
              "ResponseHeadersPolicyId": "67f7725c-6f97-4210-82d7-5512b31e9d03",
              "TargetOriginId": "S3",
              "ViewerProtocolPolicy": "redirect-to-https"
            },
            {
              "PathPattern": "login/*",
              "AllowedMethods": ["GET", "HEAD", "OPTIONS"],
              "Compress": true,
              "CachePolicyId": { "Ref": "HostVaryFrontCachingPolicy" },
              "OriginRequestPolicyId": { "Ref": "LoginUIHostVaryFrontOriginRequestPolicy" },
              "ResponseHeadersPolicyId": "67f7725c-6f97-4210-82d7-5512b31e9d03",
              "TargetOriginId": "S3",
              "ViewerProtocolPolicy": "redirect-to-https",
              "LambdaFunctionAssociations": [
                {
                  "EventType": "origin-request",
                  "IncludeBody": true,
                  "LambdaFunctionARN": {
                    "Fn::Sub": "${LambdaFunctionAutoVersion.Version}"
                  }
                }
              ]
            },
          ],
          "DefaultCacheBehavior": {
            "AllowedMethods": ["GET", "HEAD", "OPTIONS"],
            "Compress": true,
            "CachePolicyId": { "Ref": "ProtectedRouteCachingPolicy" },
            "OriginRequestPolicyId": "88a5eaf4-2fd4-4709-b370-b4c650ea3fcf",
            "ResponseHeadersPolicyId": "67f7725c-6f97-4210-82d7-5512b31e9d03",
            "TargetOriginId": "S3",
            "ViewerProtocolPolicy": "redirect-to-https",
            "LambdaFunctionAssociations": [
              {
                "EventType": "origin-request",
                "IncludeBody": true,
                "LambdaFunctionARN": {
                  "Fn::Sub": "${LambdaFunctionAutoVersion.Version}"
                }
              }
            ]
          },
          "ViewerCertificate": { "Fn::If": ["DeployCustomDomain",
          {
            "AcmCertificateArn": { "Ref": "TLSCertificate"},
            "MinimumProtocolVersion": "TLSv1.2_2021",
            "SslSupportMethod": "sni-only"
          }, { "Ref": "AWS::NoValue" }]
          }
        }
      }
    },

    "ProdRoute53": {
      "Type": "AWS::Route53::RecordSet",
      "Condition": "DeployCustomDomain",
      "Properties": {
        "AliasTarget": {
          "DNSName": { "Fn::GetAtt": ["CloudFrontDistribution", "DomainName"] },
          "HostedZoneId": "Z2FDTNDATAQYW2"
        },
        "HostedZoneId": { "Ref": "proxyRoute53HostedZoneId" },
        "Name": { "Fn::Sub": "${proxyCustomDomain}" },
        "Type": "A"
      }
    },
    "ProdRoute53Ipv6": {
      "Type": "AWS::Route53::RecordSet",
      "Condition": "DeployCustomDomain",
      "Properties": {
        "AliasTarget": {
          "DNSName": { "Fn::GetAtt": ["CloudFrontDistribution", "DomainName"] },
          "HostedZoneId": "Z2FDTNDATAQYW2"
        },
        "HostedZoneId": { "Ref": "proxyRoute53HostedZoneId" },
        "Name": { "Fn::Sub": "${proxyCustomDomain}" },
        "Type": "AAAA"
      }
    }
  },
  "Outputs": {
    "IdentityAwareProxyDomain": {
      "Description": "The domain generated for the Identity Aware Proxy.",
      "Value": {
        "Fn::If": ["DeployCustomDomain", { "Fn::Sub": "${proxyCustomDomain}" }, { "Fn::GetAtt": ["CloudFrontDistribution", "DomainName"] }]
      },
      "Export": {
        "Name": "IdentityAwareProxyDomain"
      }
    }
  }
}