serverless.yml

service: proxyfront

provider:
  name: aws
  runtime: nodejs8.10
  stage: ${file(./config.${opt:stage}.yml):STAGE}

plugins:
  - serverless-lambda-version
  - serverless-prune-plugin
  - "@vingle/serverless-tag-plugin"

custom:
  prune:
    automatic: true
    number: 5

package:
  artifact: dst.zip

functions:
  originRequest:
    handler: handlers/origin-request.handler
    memorySize: 128
    timeout: 15
    role: LambdaEdgeRole
  originResponse:
    handler: handlers/origin-response.handler
    memorySize: 128
    timeout: 1
    role: LambdaEdgeRole

resources:
  Conditions:
    CreateRoute53Records:
      Fn::Equals:
        - ${file(./config.${opt:stage}.yml):CREATE_ROUTE53_RECORDS}
        - "true"

  Resources:
    S3Bucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: ${file(./config.${opt:stage}.yml):BUCKET_NAME}

    CloudfrontDistribution:
      DependsOn: S3Bucket
      Type: AWS::CloudFront::Distribution
      Properties:
        DistributionConfig:
          Aliases: ${file(./config.${opt:stage}.yml):CLOUDFRONT_CUSTOM_DOMAIN_NAMES}
          Origins:
            # This is dummy domain name. ProxyFront never sends actual requests to this domain!
            - DomainName: aws.amazon.com
              Id: DummyOrigin
              CustomOriginConfig:
                OriginProtocolPolicy: http-only
          Enabled: true
          Comment: proxyfront-${opt:stage}
          IPV6Enabled: true
          DefaultCacheBehavior:
            AllowedMethods: ${file(./config.${opt:stage}.yml):CLOUDFRONT_ALLOWED_METHODS}
            TargetOriginId: DummyOrigin
            DefaultTTL: ${file(./config.${opt:stage}.yml):CLOUDFRONT_DEFAULT_TTL}
            MinTTL: ${file(./config.${opt:stage}.yml):CLOUDFRONT_MIN_TTL}
            MaxTTL: ${file(./config.${opt:stage}.yml):CLOUDFRONT_MAX_TTL}
            ForwardedValues:
              QueryString: true
              Cookies:
                Forward: ${file(./config.${opt:stage}.yml):CLOUDFRONT_FORWARD_COOKIE}
              Headers: ${file(./config.${opt:stage}.yml):CLOUDFRONT_FORWARD_HEADER}
            ViewerProtocolPolicy: redirect-to-https
            LambdaFunctionAssociations:
              - EventType: origin-request
                LambdaFunctionARN: OriginRequestLambdaFunction
              - EventType: origin-response
                LambdaFunctionARN: OriginResponseLambdaFunction
          CustomErrorResponses:
            - ErrorCode: 400
              ErrorCachingMinTTL: 0
            - ErrorCode: 403
              ErrorCachingMinTTL: 0
            - ErrorCode: 404
              ErrorCachingMinTTL: 0
            - ErrorCode: 405
              ErrorCachingMinTTL: 0
            - ErrorCode: 414
              ErrorCachingMinTTL: 0
            - ErrorCode: 500
              ErrorCachingMinTTL: 0
            - ErrorCode: 501
              ErrorCachingMinTTL: 0
            - ErrorCode: 502
              ErrorCachingMinTTL: 0
            - ErrorCode: 503
              ErrorCachingMinTTL: 0
            - ErrorCode: 504
              ErrorCachingMinTTL: 0
          HttpVersion: http2
          PriceClass: PriceClass_All
          ViewerCertificate: ${file(./config.${opt:stage}.yml):CLOUDFRONT_VIEWER_CERTIFICATE}
          Logging:
            Bucket:
              Fn::GetAtt:
                - S3Bucket
                - DomainName
            Prefix: logs/cloudfront/raw/

    CloudfrontRoute53Record:
      Condition: CreateRoute53Records
      Type: AWS::Route53::RecordSet
      Properties:
        Comment: proxyfront Cloudfront ${opt:stage} A (IPv4) Record
        HostedZoneId: ${file(./config.${opt:stage}.yml):ROUTE53_HOSTED_ZONE_ID}
        Name: ${file(./config.${opt:stage}.yml):ROUTE53_DOMAIN_NAME}
        Type: A
        AliasTarget:
          # @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-aliastarget.html#cfn-route53-aliastarget-hostedzoneid
          HostedZoneId: Z2FDTNDATAQYW2 # This value is AWS-defined constant value.
          DNSName:
            Fn::Join:
              - "."
              - - Fn::GetAtt: [CloudfrontDistribution, DomainName]
                - ""

    CloudfrontRoute53IPv6Record:
      Condition: CreateRoute53Records
      Type: AWS::Route53::RecordSet
      Properties:
        Comment: proxyfront Cloudfront ${opt:stage} AAAA (IPv6) Record
        HostedZoneId: ${file(./config.${opt:stage}.yml):ROUTE53_HOSTED_ZONE_ID}
        Name: ${file(./config.${opt:stage}.yml):ROUTE53_DOMAIN_NAME}
        Type: AAAA
        AliasTarget:
          # @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-aliastarget.html#cfn-route53-aliastarget-hostedzoneid
          HostedZoneId: Z2FDTNDATAQYW2 # This value is AWS-defined constant value.
          DNSName:
            Fn::Join:
              - "."
              - - Fn::GetAtt: [CloudfrontDistribution, DomainName]
                - ""

    LambdaEdgeRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - edgelambda.amazonaws.com
                  - lambda.amazonaws.com
              Action:
                - sts:AssumeRole
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole