master.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Description

Parameters:
  Tag:
    Description: We tag all AWS resources for your convinience.
    Type: String
    Default: ghost

  HostedZoneId:
    Description: AWS Route53 HostedZone Id
    Type: String

  TemplatesBucket:
    Description: Specify build-cleaved-pipelines-templats S3 Bucket
    Type: String
    Default: on-aws-us-east-1-master

  SMTPServer:
    Description: SMTP Server Name
    Type: String
    Default: email-smtp.us-east-1.amazonaws.com

  MailUser:
    Description: SMTP username
    Type: String

  MailPass:
    Description: SMTP password
    Type: String
    NoEcho: true

  MailFromAddress:
    Description: Mail sent from
    Type: String

Resources:
  # ####################
  # CFN CUSTOM RESOURCES
  # ####################
  ROUTE53:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub https://s3.amazonaws.com/${TemplatesBucket}/custom/route53/template.yaml
      Parameters:
        Tag: !Ref Tag

  GetHostedZone:
    Type: Custom::CustomResource
    Properties:
      ServiceToken: !GetAtt ROUTE53.Outputs.ServiceToken
      Id: !Ref HostedZoneId

  # ####################
  # HELPERS
  # ####################
  INVALIDATOR:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub https://s3.amazonaws.com/${TemplatesBucket}/helpers/cloudfront/invalidate-on-s3-event.yaml

  # ####################
  # Ssl Certificate
  # ####################
  SslCert:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !GetAtt GetHostedZone.Name
      SubjectAlternativeNames:
        - !Sub
          - '*.${Name}'
          -
            Name: !GetAtt GetHostedZone.Name
      ValidationMethod: DNS
      Tags:
        - Key: App
          Value: !Ref Tag
        - Key: Name
          Value: !Ref Tag

  # #################################
  # CDN for your publication's images
  # #################################
  OriginBucket:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      NotificationConfiguration:
        QueueConfigurations:
          - Queue: !GetAtt INVALIDATOR.Outputs.Queue
            Event: s3:ObjectCreated:*
          - Queue: !GetAtt INVALIDATOR.Outputs.Queue
            Event: s3:ObjectRemoved:*

  OriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: Origin Access Identity allows CloudFront Distribution to read data from S3 Bucket

  OriginBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref OriginBucket
      PolicyDocument:
        Statement:
          -
            Action:
              - s3:GetObject
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${OriginAccessIdentity}
            Resource: !Sub arn:aws:s3:::${OriginBucket}/*

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Comment: !Sub
          - https://images.${Name}
          -
            Name: !GetAtt GetHostedZone.Name
        Aliases:
          - !Sub
            - images.${Name}
            -
              Name: !GetAtt GetHostedZone.Name
        DefaultCacheBehavior:
          TargetOriginId: images
          ViewerProtocolPolicy: redirect-to-https
          Compress: true
          ForwardedValues:
            QueryString: false
        DefaultRootObject: index.html
        Enabled: true
        HttpVersion: http2
        Origins:
          - Id: images
            DomainName: !GetAtt OriginBucket.DomainName
            OriginPath: /images
            S3OriginConfig:
              OriginAccessIdentity: !Sub origin-access-identity/cloudfront/${OriginAccessIdentity}
        PriceClass: PriceClass_All
        ViewerCertificate:
          AcmCertificateArn: !Ref SslCert
          MinimumProtocolVersion: TLSv1.2_2019
          SslSupportMethod: sni-only
      Tags:
        - Key: App
          Value: !Ref Tag
        - Key: Name
          Value: !Ref Tag

  DnsRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref HostedZoneId
      Name: !Sub
        - images.${Name}
        -
          Name: !GetAtt GetHostedZone.Name
      Type: A
      AliasTarget:
        DNSName: !GetAtt CloudFrontDistribution.DomainName
        HostedZoneId: Z2FDTNDATAQYW2 # Specify Z2FDTNDATAQYW2. This is always the hosted zone ID when you create an alias record that routes traffic to a CloudFront distribution.

  # ####################
  # INFRASTRUCTURE
  # ####################
  VPC:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub https://s3.amazonaws.com/${TemplatesBucket}/vpc/template.yaml
      Parameters:
        Tag: ghost

  DATABASE:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub https://s3.amazonaws.com/${TemplatesBucket}/aurora/template.yaml
      Parameters:
        Tag: ghost
        VPC: !GetAtt VPC.Outputs.VPC
        PrivateSubnets: !GetAtt VPC.Outputs.PrivateSubnets
        ComputeSecurityGroup: !GetAtt VPC.Outputs.SecurityGroup

  GHOST:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub https://s3.amazonaws.com/${TemplatesBucket}/ghost/cluster.yaml
      Parameters:
        Tag: ghost
        VPC: !GetAtt VPC.Outputs.VPC
        PrivateSubnets: !GetAtt VPC.Outputs.PrivateSubnets
        PublicSubnets: !GetAtt VPC.Outputs.PublicSubnets
        SecurityGroup: !GetAtt VPC.Outputs.SecurityGroup
        DBSecretId: !GetAtt DATABASE.Outputs.DBSecretId
        DomainName: !GetAtt GetHostedZone.Name
        HostedZoneId: !Ref HostedZoneId
        SslCert: !Ref SslCert
        BucketName: !Ref OriginBucket
        SMTPServer: !Ref SMTPServer
        MailUser: !Ref MailUser
        MailPass: !Ref MailPass
        MailFromAddress: !Ref MailFromAddress