Automated deployment of static web pages from a repository to an S3 bucket on AWS

BucketLogs:
	Type: AWS::S3::Bucket
	Properties:
		BucketName: !Sub '${DomainName}-logs'
		AccessControl: LogDeliveryWrite
		# Encryption configuration with S3 managed keys
		BucketEncryption:
			ServerSideEncryptionConfiguration:
				- ServerSideEncryptionByDefault:
						SSEAlgorithm: AES256
		# Lifecycle configuration to expire logs after days defined in LogRetention parameter
		LifecycleConfiguration:
		Rules:
			- Id: DeleteLogsAfterTwoMonths
				Status: Enabled
				Prefix: hosting/
				ExpirationInDays: !Ref LogRetention

Bucket:
	Type: AWS::S3::Bucket
	Properties:
		BucketName: !Ref DomainName
		# Encryption configuration with S3 managed keys
		BucketEncryption:
			ServerSideEncryptionConfiguration:
				- ServerSideEncryptionByDefault:
						SSEAlgorithm: AES256
		# Logs configuration
		LoggingConfiguration:
			DestinationBucketName: !Ref BucketLogs
			LogFilePrefix: hosting/

BucketPolicy:
	Type: AWS::S3::BucketPolicy
	Properties:
		Bucket: !Ref Bucket
		PolicyDocument:
		Version: '2012-10-17'
		Statement:
			- Action:
				- s3:GetObject
			Effect: Allow
			Resource: !Sub '${Bucket.Arn}/*'
			Principal:
				CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId

CloudFront:
	Type: AWS::CloudFront::Distribution
	Properties:
		DistributionConfig:
		# Custom domain name
		Aliases:
			- !Ref DomainName
		# A name for the distribution
		Comment: !Sub 'CloudFront distribution for ${DomainName}'
		DefaultCacheBehavior:
			# Content will be compressed before it is cached (gzip), unless specifically instructed otherwise
			Compress: true
			# Cache content for 1 day
			DefaultTTL: 86400
			# Pass query strings to the origin
			ForwardedValues:
			QueryString: true
			# Max cache content for 1 year
			MaxTTL: 31536000
			# Only allow HTTPS
			ViewerProtocolPolicy: redirect-to-https
			# Set the response headers policy
			ResponseHeadersPolicyId: !Ref ResponseHeadersPolicy
			TargetOriginId: !Sub 'S3Bucket-${AWS::StackName}'
		DefaultRootObject: !Ref RootDocumentPath
		CustomErrorResponses:
			- ErrorCachingMinTTL: 300
				ErrorCode: 404
				ResponseCode: 200
				ResponsePagePath: !Ref ErrorDocumentPath
			- ErrorCachingMinTTL: 300
				ErrorCode: 403
				ResponseCode: 200
				ResponsePagePath: !Ref ErrorDocumentPath
		IPV6Enabled: true
		Enabled: true
		HttpVersion: http2and3
		# Set the origin to the S3 bucket and specify the origin access identity
		Origins:
			- DomainName: !GetAtt Bucket.DomainName
				Id: !Sub 'S3Bucket-${AWS::StackName}'
				S3OriginConfig:
					OriginAccessIdentity:
						!Join ['', ['origin-access-identity/cloudfront/', !Ref CloudFrontOriginAccessIdentity]]
		# Allow CloudFront to use the all edge location
		PriceClass: 'PriceClass_All'
		# Set the certificate
		ViewerCertificate:
			AcmCertificateArn: !Ref CertificateArn
			MinimumProtocolVersion: 'TLSv1.1_2016'
			SslSupportMethod: 'sni-only'

ResponseHeadersPolicy:
	Type: AWS::CloudFront::ResponseHeadersPolicy
	Properties:
		ResponseHeadersPolicyConfig:
		# A name for the ResponseHeadersPolicy
		Name: !Sub "${AWS::StackName}-static-site-security-headers"
		# Specifies the security headers configuration
		SecurityHeadersConfig:
			# Specifies the Strict Transport Security (HSTS) header
			StrictTransportSecurity:
				# Specifies the maximum age (in seconds) for which the browser should cache the HSTS policy
				AccessControlMaxAgeSec: 63072000
				# Indicates whether the HSTS policy should apply to all subdomains
				IncludeSubdomains: true
				# Specifies whether to override an existing HSTS policy
				Override: true
				# Specifies whether to preload the HSTS policy in supported browsers
				Preload: true
			# Specifies the Content Security Policy (CSP) header
			ContentSecurityPolicy:
				# Specifies the CSP header value
				ContentSecurityPolicy: !Ref CSPHeader
				# Specifies whether to override an existing CSP policy
				Override: true
			# Specifies the X-Content-Type-Options header
			ContentTypeOptions:
				# Specifies whether to override an existing X-Content-Type-Options policy
				Override: true
			# Specifies the X-Frame-Options header
			FrameOptions:
				# Specifies the value of the X-Frame-Options header
				FrameOption: DENY
				# Specifies whether to override an existing X-Frame-Options policy
				Override: true
			# Specifies the Referrer-Policy header
			ReferrerPolicy:
				# Specifies the value of the Referrer-Policy header
				ReferrerPolicy: "same-origin"
				# Specifies whether to override an existing Referrer-Policy policy
				Override: true
			# Specifies the X-XSS-Protection header
			XSSProtection:
				# Specifies whether to block pages from loading when they detect reflected cross-site scripting (XSS) attacks
				ModeBlock: true
				# Specifies whether to override an existing X-XSS-Protection policy
				Override: true
				# Specifies whether to enable the XSS Protection policy
				Protection: true

CloudFrontOriginAccessIdentity:
	Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
	Properties:
		CloudFrontOriginAccessIdentityConfig:
			Comment: !Sub 'CloudFront OAI for ${DomainName}'

Repository:
	Type: AWS::CodeCommit::Repository
	Properties:
		RepositoryName: MyWebsite
		RepositoryDescription: CodeCommit repository for MyWebsite
		# For each new commit on the master branch, a new deployment on S3 will be triggered through a Lambda function
		Triggers:
			- Events:
					- updateReference
				DestinationArn: !GetAtt SyncCodeCommitWithS3Function.Arn
				Name: SyncCodeCommitWithS3Trigger
				Branches:
					- !Ref BranchName

SyncCodeCommitWithS3Topic:
	Type: AWS::SNS::Topic
	Properties:
		TopicName: SyncCodeCommitWithS3
		DisplayName: SyncCodeCommitWithS3

SyncCodeCommitWithS3EmailSubscription:
	Type: AWS::SNS::Subscription
	Properties:
		TopicArn: !Ref SyncCodeCommitWithS3Topic
		Protocol: email
		Endpoint: !Ref SubscriptionEndpoint

SyncCodeCommitWithS3FunctionRole:
	Type: AWS::IAM::Role
	Properties:
		RoleName: SyncCodeCommitWithS3FunctionRole
		Description: Lambda Role to perform logs and sync file from CodeCommit With a S3 bucket and invalidates the CloudFront distribution cache for that files.
		AssumeRolePolicyDocument:
		Version: "2012-10-17"
		Statement:
			- Effect: Allow
				Principal:
				Service:
					- lambda.amazonaws.com
				Action:
					- 'sts:AssumeRole'

SyncCodeCommitWithS3FunctionRolePolicy:
	Type: AWS::IAM::Policy
	Properties:
	PolicyName: SyncCodeCommitWithS3FunctionRolePolicy
	PolicyDocument:
		Version: '2012-10-17'
		Statement:
			- Effect: Allow
				Action:
					- logs:CreateLogGroup
				Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*"
			- Effect: Allow
				Action:
					- logs:CreateLogStream
					- logs:PutLogEvents
				Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${SyncCodeCommitWithS3Function}:*"
			- Effect: Allow
				Action: 
					- codecommit:GetCommit
					- codecommit:GetDifferences
					- codecommit:GetFile
				Resource: !GetAtt Repository.Arn
			- Effect: Allow
				Action:
					- s3:PutObject
					- s3:DeleteObject
				Resource: !Sub '${Bucket.Arn}/*'
			- Effect: Allow
				Action:
					- cloudfront:CreateInvalidation
				Resource: !Sub 'arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFront}'
			- Effect: Allow
				Action:
				- sns:Publish
				Resource: !Ref SyncCodeCommitWithS3Topic
		Roles:
			- !Ref SyncCodeCommitWithS3FunctionRole

SyncCodeCommitWithS3FunctionResourcePolicy:
	Type: AWS::Lambda::Permission
	Properties:
		Action: lambda:InvokeFunction
		FunctionName: !Ref SyncCodeCommitWithS3Function
		Principal: codecommit.amazonaws.com
		SourceArn: !GetAtt Repository.Arn

SyncCodeCommitWithS3Function:
	Type: AWS::Lambda::Function
	Properties:
		FunctionName: SyncCodeCommitWithS3
		Description: Function that sync file from CodeCommit With a S3 bucket and invalidates the CloudFront distribution cache for that files.
		Runtime: python3.10
		Architectures:
			- x86_64
		MemorySize: 128
		# Timeout in seconds. Increase if you have commits with a lot of files to sync
		Timeout: !Ref LambdaTimeout
		# Place Lambda function code in S3 and reference it here. Zip file must contain the index.py file
		Code:
			S3Bucket: !Ref LambdaS3Bucket
			S3Key: !Ref LambdaS3Key
		PackageType: Zip
		Handler: index.lambda_handler
		Role: !GetAtt SyncCodeCommitWithS3FunctionRole.Arn
		# Define environment variables to know the bucket name and the CloudFront distribution ID
		Environment:
			Variables:
				bucketName: !Ref Bucket
				distributionId: !Ref CloudFront
				topicArn: !Ref SyncCodeCommitWithS3Topic

# Boto3 is the official AWS library for Python
import boto3
# Import the time library to get the current time
import time
# Import the os library to get environment variables
import os

# Create an instance of the CodeCommit, S3, SNS and CloudFront client
codecommit = boto3.client('codecommit')
s3 = boto3.client('s3')
cloudfront = boto3.client('cloudfront')
sns = boto3.client('sns')

# Get the bucket name and distribution id from the environment variables
try:
	bucketName = os.environ['bucketName']
	distributionId = os.environ['distributionId']
	topicArn = os.environ['topicArn']
except Exception as e:
	raise Exception('Missing environment variable: ' + str(e))

# All the possible MIME types
contentTypes = {
	'3dm': 'x-world/x-3dmf',
	'3dmf': 'x-world/x-3dmf',
	'3g2': 'video/3gpp2',
	...
}

# Handler function
def lambda_handler(event, context):
	
	# Get the repository name and the id of the last commit made
	repoName = event['Records'][0]['eventSourceARN'].split(':')[-1]
	lastCommitId = event['Records'][0]['codecommit']['references'][0]['commit']

	try:
		# Get commit information to get the id of the commit prior to the last commit made
		commitInfo = codecommit.get_commit(
			repositoryName = repoName,
			commitId = lastCommitId
		)
	except Exception as e:
		sns.publish(TopicArn = topicArn, Message = 'Error getting commit information: ' + str(e), Subject = 'Sync Error')
		return {
			'statusCode': 500,
			'body': 'Error getting commit information: ' + str(e)
		}

	# Get the id of the commit prior to the last commit made
	parentCommitId = commitInfo['commit']['parents'][0] if commitInfo['commit']['parents'] else None

	try:
		# Get the changes that have occurred in the last commit made
		if parentCommitId:
			commitChanges = codecommit.get_differences(
				repositoryName = repoName,
				afterCommitSpecifier = lastCommitId,
				beforeCommitSpecifier = parentCommitId
			)
		else:
			commitChanges = codecommit.get_differences(
				repositoryName = repoName,
				afterCommitSpecifier = lastCommitId
			)
	except Exception as e:
		sns.publish(TopicArn = topicArn, Message = 'Error getting commit changes: ' + str(e), Subject = 'Sync Error')
		return {
			'statusCode': 500,
			'body': 'Error getting commit changes: ' + str(e)
		}

	# Declare three arrays to group the updated, deleted and invalidated files| Populate the arrays using list comprehension
	updatedFiles = [difference['afterBlob']['path'] for difference in commitChanges['differences'] if difference.get('afterBlob') and difference['afterBlob'].get('path')]
	deletedFiles = [difference['beforeBlob']['path'] for difference in commitChanges['differences'] if difference.get('beforeBlob') and difference['beforeBlob'].get('path') and difference['beforeBlob']['path'] not in updatedFiles]
	invalidateFiles = []

	# Iterate over the updated files and upload them to the S3 bucket
	for filePath in updatedFiles:
		try:
			# Get the file content from CodeCommit
			codecommitFile = codecommit.get_file(
				repositoryName = repoName,
				commitSpecifier = lastCommitId,
				filePath = filePath
			)
		except Exception as e:
			sns.publish(TopicArn = topicArn, Message = 'Error getting file content from CodeCommit: ' + str(e), Subject = 'Sync Error')
			return {
				'statusCode': 500,
				'body': 'Error getting file content from CodeCommit: ' + str(e)
			}

		# Set Content-Type based on file extension
		contentType = contentTypes.get(filePath.split('.')[-1], 'text/plain')
		# For html files, remove de html extension
		filePath = filePath.replace('.html', '')
		# Add the file to the list of files to invalidate
		invalidateFiles.append('/' + filePath)

		try:
			# Use the put_object method of S3 to upload the file to the bucket
			s3.put_object(Bucket = bucketName, Key = filePath, Body = codecommitFile['fileContent'], ContentType = contentType)
		except Exception as e:
			sns.publish(TopicArn = topicArn, Message = 'Error uploading file to S3: ' + str(e), Subject = 'Sync Error')
			return {
				'statusCode': 500,
				'body': 'Error uploading file to S3: ' + str(e)
			}

	# Iterate over the deleted files and delete them from the S3 bucket
	for filePath in deletedFiles:
		# For html files, remove de html extension
		filePath = filePath.replace('.html', '')
		# Add the file to the list of files to invalidate
		invalidateFiles.append('/' + filePath)

		try:
			# Use the delete_object method of S3 to delete the file from the bucket
			s3.delete_object(Bucket = bucketName, Key = filePath)
		except Exception as e:
			sns.publish(TopicArn = topicArn, Message = 'Error deleting file from S3: ' + str(e), Subject = 'Sync Error')
			return {
				'statusCode': 500,
				'body': 'Error deleting file from S3: ' + str(e)
			}

	try:
		# Invalidate the modified files in CloudFront cache
		cloudfront.create_invalidation(
			DistributionId = distributionId,
			InvalidationBatch = {
				'Paths': {
					'Quantity': len(invalidateFiles),
					'Items': invalidateFiles
				},
				'CallerReference': str(time.time()).replace('.', '')
			}
		)
	except Exception as e:
		sns.publish(TopicArn = topicArn, Message = 'Error invalidating files in CloudFront: ' + str(e), Subject = 'Sync Error')
		return {
			'statusCode': 500,
			'body': 'Error invalidating files in CloudFront: ' + str(e)
		}

	# Return a 200 response
	return {
		'statusCode': 200,
		'body': 'All correct!'
	}