template.yml

AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Description: Simple static website using S3 and API gateway
Parameters:
  bucketName:
    Description: The S3 bucket name (lowercase letters, numbers, dots, dashes)
    Type: String
    MinLength: 1
    MaxLength: 50
  stageName:
    Description: The REST API stage (version) name
    Type: String
    MinLength: 1
    MaxLength: 50
    Default: v1
  enableCustomDomainName:
    Description: Whether to use the custom domain name
    Default: false
    Type: String
    AllowedValues:
      - true
      - false
  domainName:
    Description: The custom domain name
    Type: String
    MinLength: 1
    MaxLength: 50
    Default: "x"
  certificateArn:
    Description: The ARN of the DNS certificate for the custom domain name
    Type: String
    MinLength: 1
    MaxLength: 100
    Default: "x"
  useExistingLambda:
    Description: Whether to use an existing lambda for the API, specified by the input ARN
    Default: false
    Type: String
    AllowedValues:
      - true
      - false
  existingLambdaArn:
    Description: The ARN of the existing lambda to use, if useExistingLambda == true
    Type: String
    MinLength: 1
    MaxLength: 100
    Default: "x"
  captchaPathString:
    Description: Any API paths *containing* this string will be protected with a captcha
    Type: String
    MinLength: 1
    MaxLength: 50
    Default: "/captcha"
  captchaImmunitySeconds:
    Description: The time duration for which a completed captcha is valid
    Type: Number
    MinValue: 60
    MaxValue: 259200
    Default: 60

Conditions:
  useCustomDomain: !Equals
    - !Ref enableCustomDomainName
    - true
  useExternalLambda: !Equals
    - !Ref useExistingLambda
    - true
  createLambda:
    !Not [Condition: useExternalLambda]

Resources:

  websiteBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref bucketName

  bucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref bucketName
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
              - 's3:GetObject'
            Effect: Allow
            Resource: !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref bucketName
                - /*
            Principal:
              Service: "apigateway.amazonaws.com"
            Sid: "APIProxyBucketPolicy"
            Condition:
              ArnLike:
                "aws:SourceArn": !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${apiGateway.RestApiId}/*/GET/"

  getBucketRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - apigateway.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: bucketRolePolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: "s3:GetObject"
                Resource: !Join
                  - ''
                  - - 'arn:aws:s3:::'
                    - !Ref bucketName
                    - /*

  apiGateway:
    Type: AWS::ApiGateway::RestApi
    Properties:
      BinaryMediaTypes:
        - "*/*"
      DisableExecuteApiEndpoint: !Ref enableCustomDomainName
      EndpointConfiguration:
        Types:
          - "EDGE"
      FailOnWarnings: true
      Name: !Join
        - '-'
        - - !Ref "AWS::StackName"
          - "api-gateway"
      Policy:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal: "*"
            Action: "execute-api:Invoke"
            Resource: "execute-api:/*"

  apiDeployment:
    Type: AWS::ApiGateway::Deployment
    DependsOn:
      - apiStaticGET
      - apiBaseRootGET
      - apiStaticRootGET
      - apiMethod
      - apiRootGET
    Properties:
      RestApiId: !GetAtt apiGateway.RestApiId
      StageName: !Ref stageName

  apiBaseRootGET:
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: NONE
      HttpMethod: GET
      MethodResponses:
        - StatusCode: '200'
          ResponseParameters:
            method.response.header.Content-Type: true
            method.response.header.Content-Length: true
            method.response.header.Content-Encoding: false
      Integration:
        IntegrationHttpMethod: GET
        PassthroughBehavior: WHEN_NO_MATCH
        Type: AWS
        Credentials: !GetAtt getBucketRole.Arn
        Uri: !Sub "arn:aws:apigateway:${AWS::Region}:s3:path/${bucketName}/index.html"
        IntegrationResponses:
          - StatusCode: '200'
            ResponseParameters:
              method.response.header.Content-Length: integration.response.header.Content-Length
              method.response.header.Content-Type: integration.response.header.Content-Type
              method.response.header.Content-Encoding: integration.response.header.Content-Encoding
      ResourceId: !GetAtt apiGateway.RootResourceId
      RestApiId: !GetAtt apiGateway.RestApiId

  apiStaticPath:
    Type: AWS::ApiGateway::Resource
    Properties:
      ParentId: !GetAtt apiGateway.RootResourceId
      PathPart: 'static'
      RestApiId: !GetAtt apiGateway.RestApiId

  apiStaticResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      ParentId: !Ref apiStaticPath
      PathPart: '{object+}'
      RestApiId: !GetAtt apiGateway.RestApiId

  apiStaticGET:
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: NONE
      HttpMethod: GET
      RequestParameters:
        method.request.path.object: true
      MethodResponses:
        - StatusCode: '200'
          ResponseParameters:
            method.response.header.Content-Type: true
            method.response.header.Content-Length: true
            method.response.header.Content-Encoding: false
      Integration:
        IntegrationHttpMethod: GET
        PassthroughBehavior: WHEN_NO_MATCH
        Type: AWS
        Credentials: !GetAtt getBucketRole.Arn
        RequestParameters:
          integration.request.path.object: method.request.path.object
        Uri: !Sub "arn:aws:apigateway:${AWS::Region}:s3:path/${bucketName}/{object}"
        IntegrationResponses:
          - StatusCode: '200'
            ResponseParameters:
              method.response.header.Content-Length: integration.response.header.Content-Length
              method.response.header.Content-Type: integration.response.header.Content-Type
              method.response.header.Content-Encoding: integration.response.header.Content-Encoding
      ResourceId: !Ref apiStaticResource
      RestApiId: !GetAtt apiGateway.RestApiId

  apiStaticRootGET:
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: NONE
      HttpMethod: GET
      MethodResponses:
        - StatusCode: '200'
          ResponseParameters:
            method.response.header.Content-Type: true
            method.response.header.Content-Length: true
            method.response.header.Content-Encoding: false
      Integration:
        IntegrationHttpMethod: GET
        PassthroughBehavior: WHEN_NO_MATCH
        Type: AWS
        Credentials: !GetAtt getBucketRole.Arn
        Uri: !Sub "arn:aws:apigateway:${AWS::Region}:s3:path/${bucketName}/index.html"
        IntegrationResponses:
          - StatusCode: '200'
            ResponseParameters:
              method.response.header.Content-Length: integration.response.header.Content-Length
              method.response.header.Content-Type: integration.response.header.Content-Type
              method.response.header.Content-Encoding: integration.response.header.Content-Encoding
      ResourceId: !Ref apiStaticPath
      RestApiId: !GetAtt apiGateway.RestApiId

  apiRootPath:
    Type: AWS::ApiGateway::Resource
    Properties:
      ParentId: !GetAtt apiGateway.RootResourceId
      PathPart: 'api'
      RestApiId: !GetAtt apiGateway.RestApiId

  apiPath:
    Type: AWS::ApiGateway::Resource
    Properties:
      ParentId: !Ref apiRootPath
      PathPart: '{path+}'
      RestApiId: !GetAtt apiGateway.RestApiId

  apiRootGET:
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: NONE
      HttpMethod: ANY
      MethodResponses:
        - StatusCode: '200'
      Integration:
        IntegrationHttpMethod: POST
        PassthroughBehavior: WHEN_NO_MATCH
        Type: AWS_PROXY
        Uri: !If
          - useExternalLambda
          - !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${existingLambdaArn}/invocations"
          - !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${theLambda.Arn}/invocations"
        IntegrationResponses:
          - StatusCode: '200'
      ResourceId: !Ref apiRootPath
      RestApiId: !GetAtt apiGateway.RestApiId

  apiMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: NONE
      HttpMethod: ANY
      MethodResponses:
        - StatusCode: '200'
      Integration:
        IntegrationHttpMethod: POST
        PassthroughBehavior: WHEN_NO_MATCH
        Type: AWS_PROXY
        Uri: !If
          - useExternalLambda
          - !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${existingLambdaArn}/invocations"
          - !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${theLambda.Arn}/invocations"
        IntegrationResponses:
          - StatusCode: '200'
      ResourceId: !Ref apiPath
      RestApiId: !GetAtt apiGateway.RestApiId

  theLambda:
    Type: AWS::Serverless::Function
    Condition: createLambda
    Properties:
      FunctionName: !Join
        - '-'
        - - !Ref "AWS::StackName"
          - "lambda"
      Handler: index.handler
      Runtime: python3.10
      Architectures:
        - x86_64
      MemorySize: 128
      LoggingConfig:
        LogFormat: Text
        LogGroup: !Ref lambdaLogGroup
      InlineCode: |
          import json
          def handler(event, _):
              print(event)
              return {
          "statusCode": 200,
          "headers": {"X-test": "Test"},
          "body": json.dumps({ "message" : "Hello."}),
          }

  lambdaLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupClass: STANDARD
      RetentionInDays: 3
      LogGroupName: !Join
        - '-'
        - - !Ref "AWS::StackName"
          - "lambda-log"

  theLambdaPermission:
    Type: AWS::Lambda::Permission
    DependsOn:
    - apiGateway
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !If
        - useExternalLambda
        - !Ref existingLambdaArn
        - !GetAtt theLambda.Arn
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${apiGateway.RestApiId}/*/*/*"

  customDomain:
    Type: AWS::ApiGateway::DomainName
    Condition: useCustomDomain
    Properties:
      DomainName: !Ref domainName
      CertificateArn: !Ref certificateArn
      SecurityPolicy: TLS_1_2
      EndpointConfiguration:
        Types:
          - EDGE

  basePathMapping:
    Type: AWS::ApiGateway::BasePathMapping
    Condition: useCustomDomain
    DependsOn:
      - customDomain
    Properties:
      DomainName: !Ref domainName
      RestApiId: !GetAtt apiGateway.RestApiId
      Stage: !Ref stageName

  webACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      DefaultAction:
        Allow: {}
      Name: !Join
        - '-'
        - - !Ref "AWS::StackName"
          - "web-acl"
      Rules:
        - Name: !Join
          - '-'
          - - !Ref "AWS::StackName"
            - "web-acl-rule"
          Action:
            Captcha: {}
          CaptchaConfig:
            ImmunityTimeProperty:
              ImmunityTime: !Ref captchaImmunitySeconds
          Priority: 0
          Statement:
            ByteMatchStatement:
              FieldToMatch:
                UriPath: {}
              PositionalConstraint: CONTAINS
              SearchString: !Ref captchaPathString
              TextTransformations:
                - Priority: 0
                  Type: NONE
          VisibilityConfig:
            CloudWatchMetricsEnabled: false
            MetricName: !Join
              - '-'
              - - !Ref "AWS::StackName"
                - "web-acl-rule-metric"
            SampledRequestsEnabled: false
      Scope: REGIONAL
      VisibilityConfig:
        CloudWatchMetricsEnabled: false
        MetricName: !Join
          - '-'
          - - !Ref "AWS::StackName"
            - "web-acl-metric"
        SampledRequestsEnabled: false