GitLabリポジトリをCodeCommitにミラーリングしてCloudFront+S3に配置する(Vue.js+CloudFormation 編)

AWSTemplateFormatVersion: 2010-09-09

Description:
  Create CloudFront and S3

Mappings:
  CachePolicyMap:
    Managed-CachingOptimized:
      Id: 658327ea-f89d-4fab-a63d-7e88639e58f6

Parameters:
  BucketName:
    Type: String
  CachePolicyName:
    Type: String

Resources:  
  # ------------------------------------------------------------#
  #  S3
  # ------------------------------------------------------------#
  s3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
            BucketKeyEnabled: true
      WebsiteConfiguration:
        IndexDocument: index.html

  s3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref s3Bucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AllowCloudFrontServicePrincipalReadOnly
            Effect: Allow
            Principal:
              Service:
                - cloudfront.amazonaws.com
            Action: s3:GetObject
            Resource: !Sub ${s3Bucket.Arn}/*
            Condition: 
              StringEquals:
                AWS:SourceArn: !Sub arn:aws:cloudfront::${AWS::AccountId}:distribution/${cloudfrontDistribution.Id}
  # ------------------------------------------------------------#
  #  CloudFront
  # ------------------------------------------------------------#
  cloudfrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Origins:
          - DomainName: !GetAtt s3Bucket.RegionalDomainName
            Id: myS3Origin
            S3OriginConfig:
              OriginAccessIdentity: ''
            OriginAccessControlId: !GetAtt OAC.Id
        DefaultCacheBehavior:
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          Compress: true
          CachePolicyId: !FindInMap [ CachePolicyMap, !Ref CachePolicyName, Id]
          ResponseHeadersPolicyId: !GetAtt cacheControl.Id
          TargetOriginId: myS3Origin
        DefaultRootObject: index.html
        HttpVersion: http2
        Enabled: true
  
  OAC:
    Type: AWS::CloudFront::OriginAccessControl
    Properties:
      OriginAccessControlConfig:
        Name: OAC
        OriginAccessControlOriginType: s3
        SigningBehavior: always
        SigningProtocol: sigv4
  
  cacheControl:
    Type: AWS::CloudFront::ResponseHeadersPolicy
    Properties:
      ResponseHeadersPolicyConfig:
        Name: add-cache-control
        CustomHeadersConfig:
          Items:
            - Header: cache-control
              Value: no-cache
              Override: false
  # ------------------------------------------------------------#
  #  Lambda
  # ------------------------------------------------------------#
  lambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: clear-clf-cache
      Role: !GetAtt lambdaRole.Arn
      Runtime: python3.11
      Handler: index.lambda_handler
      Environment:
        Variables:
          DistributionId: !GetAtt cloudfrontDistribution.Id
      Code:
        ZipFile: |
          import json
          import os
          import boto3
          import time

          codepipeline = boto3.client('codepipeline')
          cloudfront = boto3.client('cloudfront')

          def lambda_handler(event, context):
            try:
              job_id = event['CodePipeline.job']['id']
              invalidation = cloudfront.create_invalidation(DistributionId=os.environ['DistributionId'],
                InvalidationBatch = {
                  'Paths': {
                  'Items': ['/*'],
                  'Quantity': 1
                  },
                  'CallerReference': str(time.time())
                }
              )
              codepipeline.put_job_success_result(jobId = job_id)
            
            except Exception as e:
              codepipeline.put_job_failure_result(
                jobId = job_id,
                failureDetails={
                  'type': 'JobFailed',
                  'message': str(e)
                }
              )
            return {
              'statusCode': 200,
              'body': json.dumps('cloudfront cache deletion completed')
            }
    
  lambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: CloudFrontCreateInvalidationPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - cloudfront:CreateInvalidation
                Resource: !Sub arn:aws:cloudfront::${AWS::AccountId}:distribution/*
        - PolicyName: CodePilelinePutJobResultPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - codepipeline:PutJobSuccessResult
                  - codepipeline:PutJobFailureResult
                Resource: "*"

version: 0.2

phases:
  install:
    commands:
      - aws --version
  pre_build:
    commands:
      - echo Check syntax errors in cloudformation template file...
      - aws cloudformation validate-template --template-body file://cfn/cl-s3.yml
  build:
    commands:
      - echo cloudformation deploy start... 
      - aws cloudformation deploy --template-file cfn/cl-s3.yml --stack-name ${STACK_NAME} --parameter-overrides BucketName=${S3_BUCKET_NAME} CachePolicyName=${CACHE_POLICY_NAME} --capabilities CAPABILITY_IAM --no-execute-changeset
      - echo cloudformation deploy completed...