cloudformation.yaml

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  BucketName:
    Type: String
  WebsiteCertificateARN:
    Type: String
Resources:
  WebsiteBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName:
        Ref: BucketName
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: 404.html
  WebsiteBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: WebsiteBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action: "s3:GetObject"
            Effect: Allow
            Principal: "*"
            Resource:
              Fn::Sub: "arn:aws:s3:::${WebsiteBucket}/*"
  WebsiteDistribution:
    Type: AWS::CloudFront::Distribution
    DependsOn: WebsiteBucket
    Properties:
      DistributionConfig:
        Aliases:
          - job.ivelum.com
        CustomErrorResponses:
          - ErrorCode: 403
            ResponseCode: 404
            ResponsePagePath: /404.html
        Origins:
          - DomainName:
              Ref: WebsiteBucket
            Id:
              Ref: WebsiteBucket
            CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginProtocolPolicy: 'http-only'
        Enabled: 'true'
        DefaultRootObject: index.html
        DefaultCacheBehavior:
          TargetOriginId:
            Ref: WebsiteBucket
          ViewerProtocolPolicy: 'redirect-to-https'
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachedMethods:
            - GET
            - HEAD
            - OPTIONS
          Compress: true
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
            Headers:
              - Access-Control-Request-Headers
              - Access-Control-Request-Method
              - Origin
        ViewerCertificate:
          AcmCertificateArn:
            Ref: WebsiteCertificateARN
          MinimumProtocolVersion: TLSv1.2_2018
          SslSupportMethod: sni-only
  DeployUser:
    Type: AWS::IAM::User
    Properties:
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - s3:ListBucket
                Effect: Allow
                Resource:
                  Fn::Sub: "arn:aws:s3:::${WebsiteBucket}"
              - Action:
                  - s3:*Object*
                Effect: Allow
                Resource:
                  Fn::Sub: "arn:aws:s3:::${WebsiteBucket}/*"
              - Action:
                  - cloudfront:CreateInvalidation
                Effect: Allow
                Resource: "*"
              - Action:
                  - lambda:GetFunction
                  - lambda:GetFunctionConfiguration
                  - lambda:UpdateFunctionCode
                  - lambda:UpdateFunctionConfiguration
                Effect: Allow
                Resource:
                  - !GetAtt JobApplicationApplyLambda.Arn
                  - !GetAtt JobApplicationPipedriveWebhookLambda.Arn
          PolicyName: manage-static-website
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
  JobApplicationAPI:
    Type: AWS::ApiGatewayV2::Api
    Properties:
      Description: Job Application HTTP API
      Name: job-application-lambda-api
      ProtocolType: HTTP
      CorsConfiguration:
        AllowOrigins: [ "https://job.ivelum.com" ]
        AllowMethods: [ "GET", "HEAD", "OPTIONS", "POST" ]
        AllowHeaders: [ "*" ]
  JobApplicationApplyLambda:
    Type: AWS::Lambda::Function
    Properties:
      Handler: "functions.job_apply_handler"
      Role: !GetAtt LambdaExecutionRole.Arn
      Code:
        # use CF feature - it compares yaml config with its previous version
        # without looking at the actual state of the lambda function
        # this way we can update code, deps and env vars during deploy
        ZipFile: import this
      Runtime: "python3.14"
      Timeout: 10
  JobApplicationApplyAPIIntegration:
    Type: AWS::ApiGatewayV2::Integration
    Properties:
      ApiId: !Ref JobApplicationAPI
      IntegrationType: AWS_PROXY
      IntegrationUri: !GetAtt JobApplicationApplyLambda.Arn
      PayloadFormatVersion: "2.0"
  JobApplicationApplyAPIRoute:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId: !Ref JobApplicationAPI
      RouteKey: "ANY /{proxy+}"
      Target: !Sub integrations/${JobApplicationApplyAPIIntegration}
  JobApplicationApplyAPIInvokeLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref JobApplicationApplyLambda
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${JobApplicationAPI}/*/*
  JobApplicationPipedriveWebhookLambda:
    Type: AWS::Lambda::Function
    Properties:
      Handler: "functions.pipedrive_webhook_handler"
      Role: !GetAtt LambdaExecutionRole.Arn
      Code:
        # use CF feature - it compares yaml config with its previous version
        # without looking at the actual state of the lambda function
        # this way we can update code, deps and env vars during deploy
        ZipFile: import this
      Runtime: "python3.14"
      Timeout: 20
  JobApplicationPipedriveWebhookAPIIntegration:
    Type: AWS::ApiGatewayV2::Integration
    Properties:
      ApiId: !Ref JobApplicationAPI
      IntegrationType: AWS_PROXY
      IntegrationUri: !GetAtt JobApplicationPipedriveWebhookLambda.Arn
      PayloadFormatVersion: "2.0"
  JobApplicationPipedriveWebhookAPIRoute:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId: !Ref JobApplicationAPI
      RouteKey: "POST /pipedrive-webhook"
      Target: !Sub integrations/${JobApplicationPipedriveWebhookAPIIntegration}
  JobApplicationPipedriveWebhookAPIInvokeLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref JobApplicationPipedriveWebhookLambda
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${JobApplicationAPI}/*/*

Outputs:
  JobApplicationInvokeURL:
    Value: !Sub https://${JobApplicationAPI}.execute-api.${AWS::Region}.amazonaws.com