Add cloudformation template for creating s3

.github/workflows/cloudformation.yml

@@ -0,0 +1,33 @@
+name: Deploy to LocalStack
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+    steps:
+      - uses: unfor19/install-aws-cli-action@v1
+        with:
+        version: 2
+        verbose: false
+
+      - name: Setup localstack
+        env:
+          LOCALSTACK_API_KEY: ${{ secrets.LOCALSTACK_API_KEY }}
+          LOCALSTACK_AUTH_TOKEN: ${{ secrets.LOCALSTACK_AUTH_TOKEN }}
+        # https://docs.localstack.cloud/user-guide/ci/github-actions/
+        run: |
+          docker compose up -d
+          echo "Waiting for LocalStack startup..."
+          sleep 30
+          echo "Startup complete" 
+
+      - name: Deploy to LocalStack
+        run: make deploy

Makefile

@@ -55,6 +55,9 @@ gif: docker ## Generate gif image
 docker:  ## Start docker (localstack)
 	docker compose up -d
 
+deploy: ## Deploy All CloudFormation Template
+	$(MAKE) -C cloudformation deploy
+
 .DEFAULT_GOAL := help
 help:  
 	@grep -E '^[0-9a-zA-Z_-]+[[:blank:]]*:.*?## .*$$' $(MAKEFILE_LIST) | sort \

cloudformation/Makefile

@@ -0,0 +1,8 @@
+
+.DEFAULT_GOAL := help
+help: ## Show this help  
+	@grep -E '^[0-9a-zA-Z_-]+[[:blank:]]*:.*?## .*$$' $(MAKEFILE_LIST) | sort \
+	| awk 'BEGIN {FS = ":.*?## "}; {printf "\033[1;32m%-15s\033[0m %s\n", $$1, $$2}'
+
+deploy: ## Deploy CloudFormation Template
+	cd static-web-site-distribution && ./deploy.sh

cloudformation/static-web-site-distribution/deploy.sh

@@ -2,7 +2,8 @@
 set -euxo pipefail
 
 aws cloudformation create-stack \
-    --stack-name static-web-site-distribution \
-    --template-body template.yml \
-    --parameters parameters.json \
+    --endpoint-url "http://localhost:4566" \
+    --stack-name "static-web-site-distribution" \
+    --template-body "file://template.yml" \
+    --parameters "file://parameters.json" \
     --capabilities CAPABILITY_NAMED_IAM

cloudformation/static-web-site-distribution/parameters.json

@@ -1,6 +1,6 @@
 [
     { 
-        "ParameterKey" : "BucketName", 
-        "ParameterValue" : "SampleBucketNameRainbow" 
+        "ParameterKey" : "ContentBucketName", 
+        "ParameterValue" : "ContentBucketNameRainbow" 
     }
 ]

cloudformation/static-web-site-distribution/template.yml

@@ -1,32 +1,44 @@
 AWSTemplateFormatVersion: "2010-09-09"
 
 Parameters:
-  BucketName:
+  ContentBucketName:
     Type: String
     Description: "S3 Bucket Name"
 
 Resources:
-  S3Bucket:
-    Type: AWS::S3::Bucket
+  ContentBucket:
+    Type: "AWS::S3::Bucket"
+    UpdateReplacePolicy: Retain
+    DeletionPolicy: Retain
     Properties:
-      BucketName: !Sub "${BucketName}"
+      BucketName: !Ref ContentBucketName
+      OwnershipControls:
+        Rules:
+          - ObjectOwnership: BucketOwnerEnforced
+      PublicAccessBlockConfiguration:
+        BlockPublicAcls: true
+        BlockPublicPolicy: true
+        IgnorePublicAcls: true
+        RestrictPublicBuckets: true
+      BucketEncryption:
+        ServerSideEncryptionConfiguration:
+          - ServerSideEncryptionByDefault:
+              SSEAlgorithm: AES256
 
-  CloudFrontDistribution:
-    Type: AWS::CloudFront::Distribution
+  ContentBucketPolicy:
+    Type: AWS::S3::BucketPolicy
     Properties:
-      DistributionConfig:
-        Origins:
-          - Id: S3Origin
-            DomainName: !GetAtt S3Bucket.DomainName
-            S3OriginConfig:
-              OriginAccessIdentity: ""
-        Enabled: true
-        DefaultRootObject: index.html
-        DefaultCacheBehavior:
-          TargetOriginId: S3Origin
-          ViewerProtocolPolicy: redirect-to-https
-          ForwardedValues:
-            QueryString: false
-            Cookies:
-              Forward: none
-        PriceClass: PriceClass_100
+      Bucket: !Ref ContentBucket
+      PolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Sid: AllowSSLRequestsOnly
+            Action: "s3:*"
+            Effect: Deny
+            Resource:
+              - !Sub "arn:${AWS::Partition}:s3:::${ContentBucket}"
+              - !Sub "arn:${AWS::Partition}:s3:::${ContentBucket}/*"
+            Condition:
+              Bool:
+                "aws:SecureTransport": false
+            Principal: "*"