template.yml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Description: Imgproxy running on AWS Lambda

Parameters:
  FunctionName:
    Type: String
    Description: A name for the function. If you don't specify a name, stack name is used.
  ImageUri:
    Type: String
    Description: >-
      The URI of the Docker image to use for the function.
      The image must be in an Amazon Elastic Container Registry (Amazon ECR) repository.
  MemorySize:
    Type: Number
    Description: >-
      Amount of memory in megabytes to give to the function.
      AWS Lambda will allocate CPU power linearly in proportion to the amount of memory configured,
      so it's recommended to allocate at least 2048 MB of memory to the function.
    Default: 2048
    MinValue: 1024
    MaxValue: 10240
  Timeout:
    Type: Number
    Description: The amount of time in seconds that Lambda allows a function to run before stopping it.
    Default: 60
    MinValue: 1
    MaxValue: 60
  EnvironmentSystemsManagerParametersPath:
    Type: String
    Description: >-
      A path of AWS Systems Manager Parameter Store parameters that should be loaded as environment
      variables. The path should start with a slash (/) but should not have a slash (/) at the end.
      For example, if you want to load the IMGPROXY_KEY variable from the /imgproxy/prod/IMGPROXY_KEY
      parameter, the value should be /imgproxy/prod. If not set, imgproxy will load environment
      variables from the /${StackName} path.
    Default: ''
  S3Objects:
    Type: CommaDelimitedList
    Description: >-
      ARNs of S3 objects (comma delimited) that imgproxy should have access to.
      You can grant access to multiple objects with a single ARN by using wildcards.
      Example: arn:aws:s3:::my-images-bucket/*,arn:aws:s3:::my-assets-bucket/images/*
    Default: ''
  S3AssumeRoleARN:
    Type: String
    Description: >-
      ARN of IAM Role that S3 client should assume.
      This allows you to provide imgproxy access to third-party S3 buckets that the assummed IAM Role has access to
    Default: ''
  S3MultiRegion:
    Type: String
    Description: >-
      Should imgproxy be able to access S3 buckets in other regions?
      By default, imgproxy can access only S3 buckets located in the same region as imgproxy
    Default: 'No'
    AllowedValues:
      - 'Yes'
      - 'No'
  S3ClientSideDecryption:
    Type: String
    Description: >-
      Should imgproxy use S3 decryption client?
      The decription client will be used forall objects in all S3 buckets, so unecrypted objects won't be accessable
    Default: 'No'
    AllowedValues:
      - 'Yes'
      - 'No'
  PathPrefix:
    Type: String
    Description: Path prefix, beginning with a slash (/).Do not add a slash (/) at the end of the path
    Default: ''
  CreateCloudFrontDistribution:
    Type: String
    Description: >-
      Should caching CloudFront distribution be created?
    Default: 'Yes'
    AllowedValues:
      - 'Yes'
      - 'No'

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Lambda Function
        Parameters:
          - FunctionName
          - ImageUri
          - MemorySize
          - Timeout
      - Label:
          default: imgproxy Configuration
        Parameters:
          - EnvironmentSystemsManagerParametersPath
      - Label:
          default: S3 integration
        Parameters:
          - S3Objects
          - S3AssumeRoleARN
          - S3MultiRegion
          - S3ClientSideDecryption
      - Label:
          default: Endpoint
        Parameters:
          - PathPrefix
          - CreateCloudFrontDistribution
    ParameterLabels:
      FunctionName:
        default: Function name
      ImageUri:
        default: Docker image
      MemorySize:
        default: Memory size
      Timeout:
        default: Timeout
      EnvironmentSystemsManagerParametersPath:
        default: Systems Manager Parameter Store parameters path (optional)
      S3Objects:
        default: S3 objects (optional)
      S3AssumeRoleARN:
        default: IAM Role ARN to assume (optional)
      S3MultiRegion:
        default: Enable multi-region mode
      S3ClientSideDecryption:
        default: Enable client-side decryption
      PathPrefix:
        default: Path prefix (optional)
      CreateCloudFrontDistribution:
        default: Create CloudForont distribution?

Conditions:
  HaveFunctionName: !Not
    - !Equals
      - !Ref 'FunctionName'
      - ''
  HaveEnvironmentSystemsManagerParametersPath: !Not
    - !Equals
      - !Ref 'EnvironmentSystemsManagerParametersPath'
      - ''
  HaveS3Objects: !Not
    - !Equals
      - !Join
        - ''
        - !Ref 'S3Objects'
      - ''
  HaveS3AssumeRole: !Not
    - !Equals
      - !Ref 'S3AssumeRoleARN'
      - ''
  EnableS3MultiRegion: !Equals
    - !Ref 'S3MultiRegion'
    - 'Yes'
  EnableS3ClientSideDecryption: !Equals
    - !Ref 'S3ClientSideDecryption'
    - 'Yes'
  HavePathPrefix: !Not
    - !Equals
      - !Ref 'PathPrefix'
      - ''
  DeployCloudFront: !Equals
    - !Ref 'CreateCloudFrontDistribution'
    - 'Yes'

Mappings:
  OriginShieldRegionMap:
    # Regions with origin shield
    us-east-2:
      Region: us-east-2
    us-east-1:
      Region: us-east-1
    us-west-2:
      Region: us-west-2
    ap-south-1:
      Region: ap-south-1
    ap-northeast-2:
      Region: ap-northeast-2
    ap-southeast-1:
      Region: ap-southeast-1
    ap-southeast-2:
      Region: ap-southeast-2
    ap-northeast-1:
      Region: ap-northeast-1
    eu-central-1:
      Region: eu-central-1
    eu-west-1:
      Region: eu-west-1
    eu-west-2:
      Region: eu-west-2
    sa-east-1:
      Region: sa-east-1
    # Regions without origin shield
    us-west-1:
      Region: us-west-2
    af-south-1:
      Region: eu-west-1
    ap-east-1:
      Region: ap-southeast-1
    ca-central-1:
      Region: us-east-1
    eu-south-1:
      Region: eu-central-1
    eu-west-3:
      Region: eu-west-2
    eu-north-1:
      Region: eu-west-2
    me-south-1:
      Region: ap-south-1

Resources:
  ImgproxyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Architectures: [arm64]
      FunctionName: !If
        - HaveFunctionName
        - !Ref 'FunctionName'
        - !Ref 'AWS::StackName'
      PackageType: Image
      ImageUri: !Ref ImageUri
      MemorySize: !Ref MemorySize
      Timeout: !Ref Timeout
      Environment:
        Variables:
          PORT: '8080'
          IMGPROXY_LOG_FORMAT: json
          IMGPROXY_ENV_AWS_SSM_PARAMETERS_PATH: !If
            - HaveEnvironmentSystemsManagerParametersPath
            - !Ref 'EnvironmentSystemsManagerParametersPath'
            - !Join
              - ''
              - - /
                - !Ref 'AWS::StackName'
          IMGPROXY_USE_S3: '1'
          IMGPROXY_S3_ASSUME_ROLE_ARN: !If
            - HaveS3AssumeRole
            - !Ref 'S3AssumeRoleARN'
            - !Ref 'AWS::NoValue'
          IMGPROXY_S3_MULTI_REGION: !If
            - EnableS3MultiRegion
            - '1'
            - !Ref 'AWS::NoValue'
          IMGPROXY_S3_USE_DECRYPTION_CLIENT: !If
            - EnableS3ClientSideDecryption
            - '1'
            - !Ref 'AWS::NoValue'
          IMGPROXY_PATH_PREFIX: !If
            - HavePathPrefix
            - !Ref 'PathPrefix'
            - !Ref 'AWS::NoValue'
          IMGPROXY_CLOUD_WATCH_SERVICE_NAME: !If
            - HaveFunctionName
            - !Ref 'FunctionName'
            - !Ref 'AWS::StackName'
          IMGPROXY_CLOUD_WATCH_NAMESPACE: imgproxy
          IMGPROXY_CLOUD_WATCH_REGION: !Ref 'AWS::Region'

      FunctionUrlConfig:
        AuthType: NONE
        InvokeMode:  RESPONSE_STREAM
      LoggingConfig:
        LogFormat: JSON
      Policies:
        - Statement:
          - Sid: CloudWatch
            Effect: Allow
            Action:
              - cloudwatch:PutMetricData
              - cloudwatch:PutMetricStream
            Resource:
              - '*'
          - Sid: SystemsManagerAccess
            Effect: Allow
            Action:
              - ssm:GetParametersByPath
            Resource:
              - !Join
                - ''
                - - 'arn:aws:ssm:'
                  - !Ref 'AWS::Region'
                  - ':'
                  - !Ref 'AWS::AccountId'
                  - :parameter
                  - !If
                    - HaveEnvironmentSystemsManagerParametersPath
                    - !Ref 'EnvironmentSystemsManagerParametersPath'
                    - !Join
                      - ''
                      - - /
                        - !Ref 'AWS::StackName'
          - !If
            - HaveS3Objects
            - Sid: S3Access
              Effect: Allow
              Action:
                - s3:GetObject
                - s3:GetObjectVersion
              Resource: !Ref 'S3Objects'
            - !Ref 'AWS::NoValue'
          - !If
            - HaveS3AssumeRole
            - Sid: IAMRoleAssume
              Effect: Allow
              Action:
                - sts:AssumeRole
              Resource: !Ref 'S3AssumeRoleARN'
            - !Ref 'AWS::NoValue'
          - !If
            - EnableS3ClientSideDecryption
            - Sid: KMSDecrypt
              Effect: Allow
              Action:
                - kms:Decrypt
              Resource: !Join
                - ':'
                - - arn:aws:kms:*
                  - !Ref 'AWS::AccountId'
                  - key/*
            - !Ref 'AWS::NoValue'
      Tracing: Active

  CloudFrontCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Condition: DeployCloudFront
    Properties:
      CachePolicyConfig:
        Name: !Join
          - '-'
          - - !Ref 'AWS::StackName'
            - cache-policy
        DefaultTTL: 31536000
        MaxTTL: 31536000
        MinTTL: 1
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: none
          EnableAcceptEncodingBrotli: false
          EnableAcceptEncodingGzip: false
          HeadersConfig:
            HeaderBehavior: whitelist
            Headers:
              - Accept
          QueryStringsConfig:
            QueryStringBehavior: none

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Condition: DeployCloudFront
    Properties:
      DistributionConfig:
        Enabled: true
        Origins:
          - DomainName: !Select
              - 2
              - !Split ['/', !GetAtt 'ImgproxyFunctionUrl.FunctionUrl']
            Id: !Join
              - '-'
              - - !Ref 'AWS::StackName'
                - origin
            CustomOriginConfig:
              OriginProtocolPolicy: https-only
              OriginReadTimeout: !Ref 'Timeout'
            OriginPath: !Ref 'PathPrefix'
            OriginShield:
              Enabled: true
              OriginShieldRegion: !FindInMap
                - OriginShieldRegionMap
                - !Ref 'AWS::Region'
                - Region
        DefaultCacheBehavior:
          TargetOriginId: !Join
            - '-'
            - - !Ref 'AWS::StackName'
              - origin
          CachePolicyId: !Ref 'CloudFrontCachePolicy'
          ViewerProtocolPolicy: redirect-to-https
        PriceClass: PriceClass_All
        ViewerCertificate:
          CloudFrontDefaultCertificate: true

Outputs:
  FunctionArn:
    Description: The ARN of the function
    Value: !GetAtt 'ImgproxyFunction.Arn'
  DirectURL:
    Description: The direct URL endpoint for imgproxy
    Value: !GetAtt 'ImgproxyFunctionUrl.FunctionUrl'
  CloudFrontURL:
    Description: The CloudFront endpoint for imgproxy
    Value: !GetAtt 'CloudFrontDistribution.DomainName'
    Condition: DeployCloudFront
  HowToConfigure:
    Description: How to configure imgproxy
    Value: !Join
      - ''
      - - 'imgproxy loads AWS Systems Manager Parameter Store parameters from the path '
        - !If
          - HaveEnvironmentSystemsManagerParametersPath
          - !Ref 'EnvironmentSystemsManagerParametersPath'
          - !Join
            - ''
            - - /
              - !Ref 'AWS::StackName'
        - ' as environment variables at launch. For example, if you create a parameter named '
        - !Join
          - /
          - - !If
              - HaveEnvironmentSystemsManagerParametersPath
              - !Ref 'EnvironmentSystemsManagerParametersPath'
              - !Join
                - ''
                - - /
                  - !Ref 'AWS::StackName'
            - IMGPROXY_KEY
        - ', it will be loaded as the IMGPROXY_KEY environment variable.'
        - ' If you change the parameter value, you need to restart the imgproxy service to pick up'
        - ' the new value.'