serverless.yml

service: serverless-waf-demo

provider:
  name: aws
  profile: playground
  region: ${opt:region, 'eu-west-2'}
  stage: ${opt:stage, 'dev'}
  environment:
    NAME: Owen Morgan

custom:
  stage: ${opt:stage, 'dev'}
  app-bucket: owenmorgan-waf-demo-${self:custom.stage}
  app-domain: owenmorgan-waf-demo-${self:custom.stage}
  app-ssl-cert: arn::/*****
  s3Sync:
    - bucketName: ${self:custom.app-bucket}
      localDir: src/site/
  associateWaf: # API Gateway Regional WAF
      name: regional-${self:custom.stage}

plugins:
  - serverless-associate-waf
  - serverless-s3-sync

functions:
    get-name-authorizer:
        handler: src/handlers/get-name.handler

resources:

    # Application Bucket
    Resources:
      AppS3Bucket:
        Type: AWS::S3::Bucket
        Properties:
            AccessControl: PublicRead
            BucketName: "${custom.app-bucket}"
            WebsiteConfiguration:
                IndexDocument: index.html
      
      # Application Bucket Policy
      AppS3BucketPolicy:
        Type: AWS::S3::BucketPolicy
        Properties:
            Bucket:
                Ref: AppS3Bucket
            PolicyDocument:
                Statement:
                    - Sid: PublicReadGetObject
                      Effect: Allow
                      Action:
                          - s3:GetObject
                      Resource:
                          Fn::Join: ['', ['arn:aws:s3:::', { 'Ref': 'AppS3Bucket' }, '/*']]
                      Principal:
                        CanonicalUser: !GetAtt CloudFrontOriginAccessIdentity.S3CanonicalUserId
      
      # CloudFrontOriginAccessIdentity
      CloudFrontOriginAccessIdentity:
        Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
        Properties:
          CloudFrontOriginAccessIdentityConfig:
            Comment: !Ref AppS3Bucket

      # Cloudfront Distribution
      CloudFrontDistribution:
        Type: AWS::CloudFront::Distribution
        Properties:
            DistributionConfig:
                WebACLId: !Ref AppACLGlobal
                Origins:
                    - DomainName: ${self:custom.app-bucket}.s3.amazonaws.com
                      Id: S3-${self:custom.app-domain}
                      S3OriginConfig:
                        OriginAccessIdentity: !Join
                                  - ""
                                  - - "origin-access-identity/cloudfront/"
                                    - !Ref CloudFrontOriginAccessIdentity
                Enabled: 'true'
                Aliases:
                    - ${self:custom.app-domain}
                DefaultRootObject: index.html 
                CustomErrorResponses:
                    - ErrorCode: 404
                      ResponseCode: 200
                      ResponsePagePath: /index.html
                DefaultCacheBehavior:
                    AllowedMethods:
                        - GET
                    TargetOriginId: S3-${self:custom.app-domain}
                    ForwardedValues:
                        QueryString: 'false'
                        Cookies:
                            Forward: none
                    ViewerProtocolPolicy: redirect-to-https
                ViewerCertificate:
                    AcmCertificateArn: ${self:custom.app-ssl-cert}
                    SslSupportMethod: "sni-only"
          
      # Global WAF ACL (Cloudfront) #
      WhitelistIPSetGlobal: 
        Type: AWS::WAF::IPSet
        Properties: 
          Name: WhitelistGlobal-${self:custom.stage}
          IPSetDescriptors: 
            - Type: IPV4 
              Value: "88.97.29.77/32"

      WhitelistGlobalRule: 
        Type: AWS::WAF::Rule
        Properties: 
          Name: WhitelistGlobalRule-${self:custom.stage}
          MetricName: WhitelistGlobalRule
          Predicates: 
            - DataId: 
                Ref: WhitelistIPSetGlobal
              Negated: false
              Type: IPMatch  

      AppACLGlobal:
        Type: AWS::WAF::WebACL
        Properties: 
          Name: global-${self:custom.stage}
          DefaultAction: 
            Type: BLOCK
          MetricName: AppACLGlobal-${self:custom.stage}
          Rules: 
            - Action: 
                Type: ALLOW
              Priority: 1
              RuleId: 
                Ref: WhitelistGlobalRule
      
      # Regional WAF ACL (API Gateway) #
      WhitelistIPSetRegional: 
        Type: AWS::WAFRegional::IPSet
        Properties: 
          Name: WhitelistRegional-${self:custom.stage}
          IPSetDescriptors: 
            - Type: IPV4 
              Value: "88.97.29.77/32"

      WhitelistRegionalRule: 
        Type: AWS::WAFRegional::Rule
        Properties: 
          Name: WhitelistRegionalRule-${self:custom.stage}
          MetricName: WhitelistRegionalRule
          Predicates: 
            - DataId: 
                Ref: WhitelistIPSetRegional
              Negated: false
              Type: IPMatch  

      AppACLRegional:
        Type: AWS::WAFRegional::WebACL
        Properties: 
          Name: regional-${self:custom.stage}
          DefaultAction: 
            Type: BLOCK
          MetricName: AppACLRegional-${self:custom.stage}
          Rules: 
            - Action: 
                Type: ALLOW
              Priority: 1
              RuleId: 
                Ref: WhitelistRegionalRule