pipeline-cf.yml

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  CodeRepoName:
    Type: String
    Description: 'The name for the CodeCommit repository'
  CodeRepoBranchName:
    Type: String
    Default: master
    Description: 'The branch name to tie into the CodePipeline pipeline'
  CodePipelineName:
    Type: String
    Description: 'The name for the CodePipeline pipeline'
  CustomDomainZoneId:
    Type: String
    Default: ''
    Description: 'The Route 53 Zone ID that will be used to create the A record referred to in the "custom_domain" parameter'
  CustomDomain:
    Type: String
    Default: ''
    Description: The domain name for which an A record pointing to the CloudFront distribution will be created in Route53
  CustomApiDomainZoneId:
    Type: String
    Default: ''
    Description: 'The Route 53 Zone ID that will be used to create the A record referred to in the "custom_domain" parameter'
  CustomApiDomain:
    Type: String
    Default: ''
    Description: The domain name for which an A record pointing to the CloudFront distribution will be created in Route53
  EnvironmentName:
    Type: String
    Default: ''
    Description: Environment name, can be prepended to the HTML title tag
Resources:
  CodeCommitRepo:
    Type: AWS::CodeCommit::Repository
    Properties:
      RepositoryName: !Ref CodeRepoName
  IAMRoleCodePipeline:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
      Policies: 
        - PolicyName: !Sub 'AWSCodePipelineServiceRole-${AWS::Region}-${CodePipelineName}'
          PolicyDocument:
            Version: 2012-10-17
            Statement: # This statement is copied from the default one generated by CodePipeline using the AWS Console UI
              - Action:
                  - iam:PassRole
                Resource: "*"
                Effect: Allow
                Condition:
                  StringEqualsIfExists:
                    iam:PassedToService:
                      - cloudformation.amazonaws.com
                      - elasticbeanstalk.amazonaws.com
                      - ec2.amazonaws.com
                      - ecs-tasks.amazonaws.com
              - Action:
                  - codecommit:CancelUploadArchive
                  - codecommit:GetBranch
                  - codecommit:GetCommit
                  - codecommit:GetUploadArchiveStatus
                  - codecommit:UploadArchive
                Resource: "*"
                Effect: Allow
              - Action:
                  - codedeploy:CreateDeployment
                  - codedeploy:GetApplication
                  - codedeploy:GetApplicationRevision
                  - codedeploy:GetDeployment
                  - codedeploy:GetDeploymentConfig
                  - codedeploy:RegisterApplicationRevision
                Resource: "*"
                Effect: Allow
              - Action:
                  - codestar-connections:UseConnection
                Resource: "*"
                Effect: Allow
              - Action:
                  - elasticbeanstalk:*
                  - ec2:*
                  - elasticloadbalancing:*
                  - autoscaling:*
                  - cloudwatch:*
                  - s3:*
                  - sns:*
                  - cloudformation:*
                  - rds:*
                  - sqs:*
                  - ecs:*
                Resource: "*"
                Effect: Allow
              - Action:
                  - lambda:InvokeFunction
                  - lambda:ListFunctions
                Resource: "*"
                Effect: Allow
              - Action:
                  - opsworks:CreateDeployment
                  - opsworks:DescribeApps
                  - opsworks:DescribeCommands
                  - opsworks:DescribeDeployments
                  - opsworks:DescribeInstances
                  - opsworks:DescribeStacks
                  - opsworks:UpdateApp
                  - opsworks:UpdateStack
                Resource: "*"
                Effect: Allow
              - Action:
                  - cloudformation:CreateStack
                  - cloudformation:DeleteStack
                  - cloudformation:DescribeStacks
                  - cloudformation:UpdateStack
                  - cloudformation:CreateChangeSet
                  - cloudformation:DeleteChangeSet
                  - cloudformation:DescribeChangeSet
                  - cloudformation:ExecuteChangeSet
                  - cloudformation:SetStackPolicy
                  - cloudformation:ValidateTemplate
                Resource: "*"
                Effect: Allow
              - Action:
                  - codebuild:BatchGetBuilds
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuildBatches
                  - codebuild:StartBuildBatch
                Resource: "*"
                Effect: Allow
              - Effect: Allow
                Action:
                  - devicefarm:ListProjects
                  - devicefarm:ListDevicePools
                  - devicefarm:GetRun
                  - devicefarm:GetUpload
                  - devicefarm:CreateUpload
                  - devicefarm:ScheduleRun
                Resource: "*"
              - Effect: Allow
                Action:
                  - servicecatalog:ListProvisioningArtifacts
                  - servicecatalog:CreateProvisioningArtifact
                  - servicecatalog:DescribeProvisioningArtifact
                  - servicecatalog:DeleteProvisioningArtifact
                  - servicecatalog:UpdateProduct
                Resource: "*"
              - Effect: Allow
                Action:
                  - cloudformation:ValidateTemplate
                Resource: "*"
              - Effect: Allow
                Action:
                  - ecr:DescribeImages
                Resource: "*"
              - Effect: Allow
                Action:
                  - states:DescribeExecution
                  - states:DescribeStateMachine
                  - states:StartExecution
                Resource: "*"
              - Effect: Allow
                Action:
                  - appconfig:StartDeployment
                  - appconfig:StopDeployment
                  - appconfig:GetDeployment
                Resource: "*"
  S3Bucket:
    Type: AWS::S3::Bucket
  IAMRoleCodeBuild:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess
  IAMRoleCloudFormation:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - cloudformation.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess
  CodeBuildLambdasProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:4.0
        Type: LINUX_CONTAINER
      ServiceRole: !GetAtt IAMRoleCodeBuild.Arn
      Source:
        Type: CODEPIPELINE
        BuildSpec: build-buildspec.yml
  CodeBuildFrontendProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:4.0
        Type: LINUX_CONTAINER
      ServiceRole: !GetAtt IAMRoleCodeBuild.Arn
      Source:
        Type: CODEPIPELINE
        BuildSpec: deploy-buildspec.yml
  CodePipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Name: !Ref CodePipelineName
      RoleArn: !GetAtt IAMRoleCodePipeline.Arn
      ArtifactStore: 
        Location: !Ref S3Bucket
        Type: S3
      Stages:
        - Name: Source
          Actions:
            - ActionTypeId:
                Category: Source
                Owner: AWS
                Provider: CodeCommit
                Version: 1
              Name: Source
              Configuration: 
                RepositoryName: !Ref CodeRepoName
                BranchName: !Ref CodeRepoBranchName
                PollForSourceChanges: False
              OutputArtifacts:
                - Name: SourceArtifact
        - Name: BuildLambdas
          Actions:
            - ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              Name: Build
              Configuration:
                ProjectName: !Ref CodeBuildLambdasProject
                EnvironmentVariables: !Sub |
                  [
                    {
                      "name": "SAM_RESOURCES_BUCKET",
                      "value": "${S3Bucket}",
                      "type": "PLAINTEXT"
                    }
                  ]
              InputArtifacts:
                - Name: SourceArtifact
              OutputArtifacts:
                - Name: BuildArtifact
        - Name: DeployCloudformation
          Actions:
            - ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              Name: DeployFrontend
              Configuration:
                ActionMode: CREATE_UPDATE
                StackName: !Sub 'CF-${CodePipelineName}-Frontend'
                RoleArn: !GetAtt IAMRoleCloudFormation.Arn
                TemplatePath: BuildArtifact::frontend/cf.yml
                ParameterOverrides: !Sub |
                  {
                    "CustomDomainZoneId": "${CustomDomainZoneId}",
                    "CustomDomain": "${CustomDomain}"
                  }
              Namespace: CloudFormationFrontendOutputs
              InputArtifacts:
                - Name: BuildArtifact
            - ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              Name: DeployVotesService
              RunOrder: 2
              Configuration:
                ActionMode: CREATE_UPDATE
                StackName: !Sub 'CF-${CodePipelineName}-VotesService'
                RoleArn: !GetAtt IAMRoleCloudFormation.Arn
                Capabilities: CAPABILITY_IAM,CAPABILITY_AUTO_EXPAND
                TemplatePath: BuildArtifact::services/votes/sam.yml
                ParameterOverrides: !Sub |
                  {
                    "FrontendCloudFormationStackName": "CF-${CodePipelineName}-Frontend",
                    "CustomApiDomain": "${CustomApiDomain}",
                    "CustomApiDomainZoneId": "${CustomApiDomainZoneId}"
                  }
              Namespace: CloudFormationVotesOutputs
              InputArtifacts:
                - Name: BuildArtifact
        - Name: DeployFrontendStaticAssets
          Actions:
            - ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              Name: Build
              Configuration:
                ProjectName: !Ref CodeBuildFrontendProject
                EnvironmentVariables: !Sub |
                  [
                    {
                      "name": "FRONTEND_S3_BUCKET",
                      "value": "#{CloudFormationFrontendOutputs.S3Bucket}",
                      "type": "PLAINTEXT"
                    },
                    {
                      "name": "API_ENDPOINT",
                      "value": "#{CloudFormationVotesOutputs.CloudFrontDistribution}",
                      "type": "PLAINTEXT"
                    },
                    {
                      "name": "API_ID",
                      "value": "#{CloudFormationVotesOutputs.ApiGatewayId}",
                      "type": "PLAINTEXT"
                    },
                    {
                      "name": "ENVIRONMENT_NAME",
                      "value": "${EnvironmentName} - ",
                      "type": "PLAINTEXT"
                    }
                  ]
              InputArtifacts:
                - Name: BuildArtifact
  IAMRoleCloudWatchEventRole: # Adopted from: https://docs.aws.amazon.com/codepipeline/latest/userguide/update-change-detection.html#update-change-detection-cfn-codecommit
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: cwe-pipeline-execution
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: codepipeline:StartPipelineExecution
                Resource: !Sub 'arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${CodePipeline}'
  IAMRoleCloudWatchEventRule: # Adopted from: https://docs.aws.amazon.com/codepipeline/latest/userguide/update-change-detection.html#update-change-detection-cfn-codecommit
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        source:
          - aws.codecommit
        detail-type:
          - 'CodeCommit Repository State Change'
        resources:
          - !Sub 'arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:${CodeRepoName}'
        detail:
          event:
            - referenceCreated
            - referenceUpdated
          referenceType:
            - branch
          referenceName:
            - !Ref CodeRepoBranchName
      Targets:
        - Arn: !Sub 'arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${CodePipeline}'
          RoleArn: !GetAtt IAMRoleCloudWatchEventRole.Arn
          Id: !Sub 'codepipeline-${CodePipelineName}'
Outputs:
  CodeCommitHTTPCloneUrl: 
    Description: HTTP Git clone url for repository
    Value: !GetAtt CodeCommitRepo.CloneUrlHttp
    Export:
      Name: !Sub '${AWS::StackName}:CodeCommitHTTPCloneUrl'