サーバレスで実現する！ゲノムブラウザ JBrowse 2 の実行環境

AWSTemplateFormatVersion: "2010-09-09"
Description: CloudFront Logs S3 Bucket for Access Log v2 (Shared by multiple CloudFront distributions)

Parameters:
  NoncurrentVersionRetentionDays:
    Description: Number of days to retain noncurrent versions
    Type: Number
    Default: 7
    MinValue: 1
    MaxValue: 365

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Required input parameters"
        Parameters:
          - NoncurrentVersionRetentionDays

Resources:
  S3BucketLogs:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BucketName: !Sub multiple-cloudfront-logs-bucket-${AWS::AccountId}
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        BlockPublicPolicy: True
        IgnorePublicAcls: True
        RestrictPublicBuckets: True
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: "AES256"
            BucketKeyEnabled: true
      LifecycleConfiguration:
        Rules:
          - Id: AbortIncompleteMultipartUpload
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 7
            Status: "Enabled"
          - Id: DeleteOldVersions
            NoncurrentVersionExpiration:
              NoncurrentDays: !Ref NoncurrentVersionRetentionDays
            Status: Enabled

  S3BucketLogsPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3BucketLogs
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowCloudFrontServicePrincipalWrite
            Effect: Allow
            Principal:
              Service: delivery.logs.amazonaws.com
            Action:
              - s3:PutObject
            Resource: !Sub ${S3BucketLogs.Arn}/*
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref 'AWS::AccountId'

Outputs:
  LogsBucketName:
    Description: Name of the CloudFront logs bucket
    Value: !Ref S3BucketLogs
    Export:
      Name: !Sub ${AWS::StackName}-LogsBucketName
  LogsBucketArn:
    Description: ARN of the CloudFront logs bucket
    Value: !GetAtt S3BucketLogs.Arn
    Export:
      Name: !Sub ${AWS::StackName}-LogsBucketArn
  LogsBucketDomainName:
    Description: Domain name of the CloudFront logs bucket
    Value: !GetAtt S3BucketLogs.DomainName
    Export:
      Name: !Sub ${AWS::StackName}-LogsBucketDomainName

AWSTemplateFormatVersion: "2010-09-09"
Description: Static contents distribution using S3 and CloudFront with OAC

Parameters:
  ProjectName:
    Description: Project Name
    Type: String
  Description:
    Description: Description for CloudFront Distribution
    Type: String

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Required input parameters"
        Parameters:
          - ProjectName
          - Description

Resources:
  S3Bucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketName: !Sub ${ProjectName}-bucket-${AWS::AccountId}
      OwnershipControls:
        Rules:
          - ObjectOwnership: "BucketOwnerEnforced"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        BlockPublicPolicy: True
        IgnorePublicAcls: True
        RestrictPublicBuckets: True
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: "AES256"
            BucketKeyEnabled: true
      LifecycleConfiguration:
        Rules:
          - Id: AbortIncompleteMultipartUpload
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 7
            Status: "Enabled"
          - Id: TransitionToIA
            Transitions:
              - StorageClass: STANDARD_IA
                TransitionInDays: 30
            Status: "Enabled"
          - Id: NoncurrentVersionExpiration
            NoncurrentVersionExpiration:
              NewerNoncurrentVersions: 3
              NoncurrentDays: 7
            Status: Enabled

  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowCloudFrontServicePrincipal
            Effect: Allow
            Principal:
              Service: cloudfront.amazonaws.com
            Action: s3:GetObject
            Resource: !Sub ${S3Bucket.Arn}/*
            Condition:
              StringEquals:
                AWS:SourceArn: !Sub arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}

  CloudFrontOriginAccessControl:
    Type: AWS::CloudFront::OriginAccessControl
    Properties:
      OriginAccessControlConfig:
        Name: !Sub ${ProjectName}-OAC
        Description: Origin Access Control for S3
        SigningBehavior: always
        SigningProtocol: sigv4
        OriginAccessControlOriginType: s3

  OneSecondCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Name: !Sub ${ProjectName}-cache-policy
        Comment: "Cache for 1 second"
        DefaultTTL: 1
        MaxTTL: 1
        MinTTL: 1
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: none
          HeadersConfig:
            HeaderBehavior: none
          QueryStringsConfig:
            QueryStringBehavior: none
          EnableAcceptEncodingBrotli: true
          EnableAcceptEncodingGzip: true

  CloudFrontLogsDeliverySource:
    Type: AWS::Logs::DeliverySource
    Properties:
      Name: !Sub ${ProjectName}-cloudfront-delivery-source
      ResourceArn: !Sub arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}
      LogType: ACCESS_LOGS

  CloudFrontLogsDeliveryDestination:
    Type: AWS::Logs::DeliveryDestination
    Properties:
      Name: !Sub ${ProjectName}-cloudfront-delivery-destination
      DestinationResourceArn: !Sub arn:aws:s3:::multiple-cloudfront-logs-bucket-${AWS::AccountId}
      OutputFormat: json

  CloudFrontLogsDelivery:
    Type: AWS::Logs::Delivery
    DependsOn: CloudFrontLogsDeliverySource
    Properties:
      DeliverySourceName: !Sub ${ProjectName}-cloudfront-delivery-source
      DeliveryDestinationArn: !GetAtt CloudFrontLogsDeliveryDestination.Arn
      RecordFields:
        - timestamp
        - DistributionId
        - date
        - time
        - x-edge-location
        - sc-bytes
        - c-ip
        - cs-method
        - cs(Host)
        - cs-uri-stem
        - sc-status
        - cs(Referer)
        - cs(User-Agent)
        - cs-uri-query
        - cs(Cookie)
        - x-edge-result-type
        - x-edge-request-id
        - x-host-header
        - cs-protocol
        - cs-bytes
        - time-taken
        - x-forwarded-for
        - ssl-protocol
        - ssl-cipher
        - x-edge-response-result-type
        - cs-protocol-version
        - fle-status
        - fle-encrypted-fields
        - c-port
        - time-to-first-byte
        - x-edge-detailed-result-type
        - sc-content-type
        - sc-content-len
        - sc-range-start
        - sc-range-end
        - timestamp(ms)
        - origin-fbl
        - origin-lbl
        - asn
        - c-country
        - cache-behavior-path-pattern
      S3SuffixPath: !Sub ${ProjectName}/{yyyy}/{MM}/{dd}/{HH}
      S3EnableHiveCompatiblePath: false

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Comment: !Ref Description
        PriceClass: PriceClass_200
        Origins:
          - DomainName: !GetAtt S3Bucket.RegionalDomainName
            Id: S3Origin
            OriginAccessControlId: !Ref CloudFrontOriginAccessControl
            S3OriginConfig:
              OriginAccessIdentity: ''
        DefaultRootObject: index.html
        DefaultCacheBehavior:
          TargetOriginId: S3Origin
          Compress: true
          ViewerProtocolPolicy: redirect-to-https
          CachePolicyId: !Ref OneSecondCachePolicy
          OriginRequestPolicyId: 88a5eaf4-2fd4-4709-b370-b4c650ea3fcf # CORS-S3Origin
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
        HttpVersion: http2
        IPV6Enabled: true
        Enabled: true

Outputs:
  CloudFrontDomainName:
    Description: CloudFront Distribution Domain Name
    Value: !GetAtt CloudFrontDistribution.DomainName
  S3BucketName:
    Description: S3 Bucket Name
    Value: !Ref S3Bucket
  S3BucketArn:
    Description: S3 Bucket ARN
    Value: !GetAtt S3Bucket.Arn
  CloudFrontLogsDeliveryArn:
    Description: CloudFront Logs Delivery ARN
    Value: !GetAtt CloudFrontLogsDelivery.Arn