73 lines
2.3 KiB
YAML
73 lines
2.3 KiB
YAML
AWSTemplateFormatVersion: '2010-09-09'
|
|
Description: 'EventBuzz Console: S3 + CloudFront OAC + SPA Routing'
|
|
|
|
Resources:
|
|
# 1. The S3 Bucket
|
|
WebsiteBucket:
|
|
Type: 'AWS::S3::Bucket'
|
|
Properties:
|
|
BucketName: !Sub 'console-eventbuzz-v2-${AWS::AccountId}' # Unique name
|
|
PublicAccessBlockConfiguration:
|
|
BlockPublicAcls: true
|
|
BlockPublicPolicy: true
|
|
IgnorePublicAcls: true
|
|
RestrictPublicBuckets: true
|
|
|
|
# 2. Origin Access Control (The "Key")
|
|
CloudFrontOAC:
|
|
Type: 'AWS::CloudFront::OriginAccessControl'
|
|
Properties:
|
|
OriginAccessControlConfig:
|
|
Name: !Sub 'OAC-${AWS::StackName}'
|
|
OriginAccessControlOriginType: s3
|
|
SigningBehavior: always
|
|
SigningProtocol: sigv4
|
|
|
|
# 3. The CloudFront Distribution
|
|
WebsiteDistribution:
|
|
Type: 'AWS::CloudFront::Distribution'
|
|
Properties:
|
|
DistributionConfig:
|
|
Enabled: true
|
|
DefaultRootObject: index.html
|
|
Origins:
|
|
- Id: S3Origin
|
|
DomainName: !GetAtt WebsiteBucket.RegionalDomainName
|
|
OriginAccessControlId: !GetAtt CloudFrontOAC.Id
|
|
S3OriginConfig:
|
|
OriginAccessIdentity: "" # Leave empty for OAC
|
|
DefaultCacheBehavior:
|
|
TargetOriginId: S3Origin
|
|
ViewerProtocolPolicy: redirect-to-https
|
|
CachePolicyId: 65832739-81ee-4e30-a434-316882a20199 # Managed-CachingOptimized
|
|
CustomErrorResponses:
|
|
- ErrorCode: 403 # Fixes SPA Refresh Issue
|
|
ResponseCode: 200
|
|
ResponsePagePath: /index.html
|
|
- ErrorCode: 404
|
|
ResponseCode: 200
|
|
ResponsePagePath: /index.html
|
|
|
|
# 4. The Bucket Policy (The "Lock")
|
|
BucketPolicy:
|
|
Type: 'AWS::S3::BucketPolicy'
|
|
Properties:
|
|
Bucket: !Ref WebsiteBucket
|
|
PolicyDocument:
|
|
Version: '2012-10-17'
|
|
Statement:
|
|
- Action: 's3:GetObject'
|
|
Effect: Allow
|
|
Resource: !Sub 'arn:aws:s3:::${WebsiteBucket}/*'
|
|
Principal:
|
|
Service: 'cloudfront.amazonaws.com'
|
|
Condition:
|
|
StringEquals:
|
|
AWS:SourceArn: !Sub 'arn:aws:cloudfront::${AWS::AccountId}:distribution/${WebsiteDistribution}'
|
|
|
|
Outputs:
|
|
DistributionURL:
|
|
Value: !GetAtt WebsiteDistribution.DomainName
|
|
BucketName:
|
|
Value: !Ref WebsiteBucket
|