cloudformation.yml

Parameters:
  BucketName:
    Description: The name of the bucket for example hugotunius for the domain hugotunius.se
    Type: String
    MinLength: 3
    MaxLength: 63

Resources:
  WebBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      BucketName: !Ref BucketName
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: error.html

  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref WebBucket
      PolicyDocument:
        Statement:
          - Action: s3:GetObject
            Effect: Allow
            Sid: PublicReadForGetBucketObjects
            Principal:
              AWS: '*'
            Resource: !Join ['/', [ !Join [':::', [ 'arn:aws:s3', !Ref WebBucket ] ], '*' ] ]
            Condition:
              IpAddress:
                aws:SourceIp:
                  # Source https://www.cloudflare.com/en-gb/ips/
                  # Cloudflare IPv4
                  - 103.21.244.0/22
                  - 103.22.200.0/22
                  - 103.31.4.0/22
                  - 104.16.0.0/13
                  - 104.24.0.0/14
                  - 108.162.192.0/18
                  - 131.0.72.0/22
                  - 141.101.64.0/18
                  - 162.158.0.0/15
                  - 172.64.0.0/13
                  - 173.245.48.0/20
                  - 188.114.96.0/20
                  - 190.93.240.0/20
                  - 197.234.240.0/22
                  - 198.41.128.0/17
                  # Cloudflare IPv6
                  - 2400:cb00::/32
                  - 2606:4700::/32
                  - 2803:f800::/32
                  - 2405:b500::/32
                  - 2405:8100::/32
                  - 2a06:98c0::/29
                  - 2c0f:f248::/32

  BucketUploader:
    Type: AWS::IAM::User
    Properties:
      UserName: !Join ['-', [ !Ref BucketName, 'Uploader'] ]
      Policies:
        - PolicyName: BucketUpdatePolicy
          PolicyDocument:
            Version: 2008-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:*
                Resource:
                  - !Join [':::', [ 'arn:aws:s3', !Ref WebBucket ] ]
                  - !Join ['/', [ !Join [':::', [ 'arn:aws:s3', !Ref WebBucket ] ], '*' ] ]

  UploaderAccessKey:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref BucketUploader

Outputs:
  BucketAccessKey:
    Value: !Ref UploaderAccessKey
    Description: Save this key it will be used later

  BucketSecretKey:
    Value: !GetAtt UploaderAccessKey.SecretAccessKey
    Description: Save this key it will be used later

  WebsiteURL:
    Value: !GetAtt WebBucket.WebsiteURL
    Description: S3 URL for the website