cloudformation.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: "AWS::Serverless-2016-10-31"
Description: Serverless image processor
Parameters:
  CDNCertificateArn:
    Type: String
    Description: The ARN for your custom certificate from AWS Certificate Manager
    Default: ""
  CDNAliases:
    Type: CommaDelimitedList
    Description: Domains aliases associated with CloudFront distribution
    Default: ""
  S3FunctionBucket:
    Type: String
    ConstraintDescription: Must be a valid S3 Bucket.
    MinLength: "1"
    MaxLength: "64"
    AllowedPattern: "[a-zA-Z][a-zA-Z0-9-.]*"
  S3ImageBucket:
    Type: String
    ConstraintDescription: Must be a valid S3 Bucket.
    MinLength: "1"
    MaxLength: "64"
    AllowedPattern: "[a-zA-Z][a-zA-Z0-9-.]*"
  S3ImageKeyPattern:
    Type: String
    Default: ":filename"
  SERVICENAME:
    Type: String
    MinLength: "1"
    Default: imaginarium

Conditions:
  UseCustomCDNCertificate: !Not [!Equals ["", !Ref CDNCertificateArn]]

Resources:
  ImaginariumApiGWRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: "apigateway.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-agw-cloud-watch-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:DescribeLogGroups"
                  - "logs:DescribeLogStreams"
                  - "logs:PutLogEvents"
                  - "logs:GetLogEvents"
                  - "logs:FilterLogEvents"
                Resource: "*"
        - PolicyName: !Sub "${AWS::StackName}-agw-lambda-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: "lambda:InvokeFunction"
                Resource:
                  - "*"

  ImaginariumApiGWAccount:
    Type: "AWS::ApiGateway::Account"
    Properties:
      CloudWatchRoleArn: !GetAtt ImaginariumApiGWRole.Arn

  ImaginariumApiStage:
    DependsOn: [ImaginariumApiGWAccount]
    Type: AWS::ApiGateway::Stage
    Properties:
      DeploymentId: !Ref ImaginariumApiDeployment
      MethodSettings:
        - DataTraceEnabled: False
          HttpMethod: "*"
          LoggingLevel: ERROR
          ResourcePath: "/*"
      RestApiId: !Ref ImaginariumApi
      StageName: LATEST

  ImaginariumApiDeployment:
    Type: "AWS::ApiGateway::Deployment"
    Properties:
      RestApiId: !Ref ImaginariumApi
      StageName: production

  ImaginariumApi:
    DependsOn: [ImageHandlerFunction, ImaginariumApiGWRole]
    Type: "AWS::ApiGateway::RestApi"
    Properties:
      Name: !Sub ${SERVICENAME}
      EndpointConfiguration:
        Types:
          - REGIONAL
      Body:
        swagger: 2.0
        info:
          title: !Sub ${SERVICENAME} API
        basePath: /production
        schemes:
          - https
        x-amazon-apigateway-binary-media-types:
          - "image/webp"
          - "image/png"
          - "image/jpeg"
          - "text/html"
          # this is here because apigateway takes it from text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 :()
        paths:
          "/{proxy+}":
            get:
              parameters:
                - name: proxy
                  in: path
                  required: true
                  type: string
              produces:
                # by default it products html because errors
                # otherwise it will treat everything else as binary
                - application/json
              responses:
                "200":
                  description: Success
                  headers:
                    Content-Type:
                      type: string
              x-amazon-apigateway-integration:
                credentials: !GetAtt ImaginariumApiGWRole.Arn
                responses:
                  "200":
                    statusCode: 200
                uri: !Join
                  - ""
                  - - "arn:aws:apigateway:"
                    - !Ref "AWS::Region"
                    - ":"
                    - "lambda:path/2015-03-31/functions/"
                    - !GetAtt
                      - ImageHandlerFunction
                      - Arn
                    - /invocations
                httpMethod: POST
                type: aws_proxy

  ImageHandlerLogGroup:
    Type: "AWS::Logs::LogGroup"
    Properties:
      RetentionInDays: 1
      LogGroupName: !Join
        - ""
        - - /aws/lambda/
          - !Ref ImageHandlerFunction

  ImageHandlerRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Path: /
      RoleName: !Join
        - ""
        - - !Ref "AWS::StackName"
          - Role
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"

  ImageHandlerS3CodePolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: !Join
        - ""
        - - !Ref "AWS::StackName"
          - S3CodeReadPolicy
      Roles:
        - !Ref ImageHandlerRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "s3:GetObject"
            Resource:
              - !Sub arn:aws:s3:::${S3FunctionBucket}/*

  ImageHandlerS3ImagesReadPolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: !Join
        - ""
        - - !Ref "AWS::StackName"
          - S3ImagesReadPolicy
      Roles:
        - !Ref ImageHandlerRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "s3:GetObject"
            Resource:
              - !Sub arn:aws:s3:::${S3ImageBucket}/*

  ImageHandlerLogPolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: !Join
        - ""
        - - !Ref "AWS::StackName"
          - LogPolicy
      Roles:
        - !Ref ImageHandlerRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "logs:CreateLogGroup"
              - "logs:CreateLogStream"
              - "logs:PutLogEvents"
            Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"

  ImageHandlerPermission:
    DependsOn: [ImageHandlerFunction]
    Type: "AWS::Lambda::Permission"
    Properties:
      Action: "lambda:invokeFunction"
      FunctionName: !GetAtt ImageHandlerFunction.Arn
      Principal: apigateway.amazonaws.com
      SourceAccount: !Ref AWS::AccountId
      SourceArn: !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/*/*/*"

  ImageHandlerFunction:
    Type: "AWS::Serverless::Function"
    Properties:
      CodeUri: ./dist
      Description: Imaginarium image handler
      FunctionName: !Sub ${SERVICENAME}
      Handler: index.handler
      MemorySize: 1536 # more computing power
      Runtime: nodejs10.x
      Timeout: 10 # 10 seconds timeout

      Tags:
        Service: !Ref SERVICENAME

      Environment:
        Variables:
          S3_IMAGE_BUCKET: !Ref S3ImageBucket
          S3_IMAGE_KEY_PATTERN: !Ref S3ImageKeyPattern

      Role: !GetAtt ImageHandlerRole.Arn

  CDN:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Aliases: !Ref CDNAliases
        Enabled: True
        HttpVersion: http2
        Comment: !Sub ${AWS::StackName} CDN distribution
        PriceClass: "PriceClass_100" # eu, usa, ca
        CustomErrorResponses:
          - ErrorCode: 405
            ErrorCachingMinTTL: 10
          - ErrorCode: 500
            ErrorCachingMinTTL: 10
          - ErrorCode: 501
            ErrorCachingMinTTL: 10
          - ErrorCode: 502
            ErrorCachingMinTTL: 10
          - ErrorCode: 503
            ErrorCachingMinTTL: 10
          - ErrorCode: 504
            ErrorCachingMinTTL: 10
        Origins:
          - DomainName: !Sub "${ImaginariumApi}.execute-api.${AWS::Region}.amazonaws.com"
            OriginPath: /production
            Id: !Ref ImaginariumApi
            CustomOriginConfig:
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
              OriginSSLProtocols:
                - TLSv1
                - TLSv1.1
                - TLSv1.2
        DefaultCacheBehavior:
          AllowedMethods: ["HEAD", "GET"]
          DefaultTTL: 0 # do not cache if Cache-Control headers are not present
          ForwardedValues:
            Cookies:
              Forward: none
            QueryString: True
            Headers:
              - Accept # cache based on Accept header so we can have one URL for multiple accepted types
          ViewerProtocolPolicy: redirect-to-https
          TargetOriginId: !Ref ImaginariumApi
        ViewerCertificate: !If
          - UseCustomCDNCertificate
          - AcmCertificateArn: !Ref CDNCertificateArn
            SslSupportMethod: sni-only
          - CloudFrontDefaultCertificate: True
      Tags:
        - Key: Service
          Value: !Ref SERVICENAME

Outputs:
  ApiUrl:
    Description: URL
    Value: !Sub "https://${ImaginariumApi}.execute-api.${AWS::Region}.amazonaws.com/production"
  CDNId:
    Description: CDN ID
    Value: !Ref CDN
  CDNUrl:
    Description: CDN URL
    Value: !GetAtt CDN.DomainName