CloudFormation & Terraform Generator

AWSTemplateFormatVersion: "2010-09-09"
Description: "Static website hosting with S3, CloudFront, and Route53"

Parameters:
  DomainName:
    Type: String
    Default: "example.com"
    Description: "Domain name for the static website"

Resources:
  # S3 bucket to store static website files
  WebsiteBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${DomainName}-website"
      WebsiteConfiguration:
        IndexDocument: "index.html"
        ErrorDocument: "404.html"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  # Bucket policy to allow CloudFront access via OAC
  WebsiteBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref WebsiteBucket
      PolicyDocument:
        Statement:
          - Sid: AllowCloudFrontOAC
            Effect: Allow
            Principal:
              Service: cloudfront.amazonaws.com
            Action: s3:GetObject
            Resource: !Sub "${WebsiteBucket.Arn}/*"
            Condition:
              StringEquals:
                AWS:SourceArn: !Sub "arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"

  # Origin Access Control for secure S3 access
  CloudFrontOAC:
    Type: AWS::CloudFront::OriginAccessControl
    Properties:
      OriginAccessControlConfig:
        Name: !Sub "${DomainName}-oac"
        OriginAccessControlOriginType: s3
        SigningBehavior: always
        SigningProtocol: sigv4

  # ACM certificate for HTTPS (must be in us-east-1 for CloudFront)
  Certificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref DomainName
      SubjectAlternativeNames:
        - !Sub "www.${DomainName}"
      ValidationMethod: DNS

  # CloudFront distribution to serve content globally with low latency
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Origins:
          - Id: S3Origin
            DomainName: !GetAtt WebsiteBucket.RegionalDomainName
            OriginAccessControlId: !GetAtt CloudFrontOAC.Id
            S3OriginConfig:
              OriginAccessIdentity: ""
        Enabled: true
        DefaultRootObject: "index.html"
        DefaultCacheBehavior:
          AllowedMethods: [GET, HEAD]
          TargetOriginId: S3Origin
          ViewerProtocolPolicy: redirect-to-https
          CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6  # CachingOptimized
          Compress: true
        ViewerCertificate:
          AcmCertificateArn: !Ref Certificate
          SslSupportMethod: sni-only
          MinimumProtocolVersion: TLSv1.2_2021
        Aliases:
          - !Ref DomainName
          - !Sub "www.${DomainName}"

  # Route53 DNS record pointing to CloudFront
  DNSRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneName: !Sub "${DomainName}."
      Name: !Ref DomainName
      Type: A
      AliasTarget:
        DNSName: !GetAtt CloudFrontDistribution.DomainName
        HostedZoneId: Z2FDTNDATAQYW2  # CloudFront hosted zone ID (constant)

Outputs:
  WebsiteURL:
    Value: !Sub "https://${DomainName}"
  CloudFrontDomain:
    Value: !GetAtt CloudFrontDistribution.DomainName
  BucketName:
    Value: !Ref WebsiteBucket