cicd-dependencies.template.yml

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31
Description: AiProxy CI/CD dependencies
    
Resources:

  # The Artifact Store holds artifacts from codebuild/pipeline so they can be passed
  # from one stage of a pipeline to the next, or so artifacts can be reviewed.
  # We use a single bucket, though multiple instances of the pipeline may exist.
  ArtifactStore:
    Type: AWS::S3::Bucket

  # This role will be used by CodeBuild to execute the CI build. Here we have
  # the common policy rules required. Since we may want to create multiple
  # codebuild projects for different branches, we can append policies when those
  # stack resources are created (in "2-cicd/cicd.template.yml")
  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: ['sts:AssumeRole']
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
                - codepipeline.amazonaws.com
        Version: '2012-10-17'
      Path: /service-role/
      Policies:
        - PolicyName: AiProxyPassRole
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action: iam:PassRole
                Resource: !Sub arn:aws:iam::${AWS::AccountId}:role/admin/CloudFormationService
        - PolicyName: AiProxyCodePipelinePolicy
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - "cloudformation:DescribeStacks"
                  - "cloudformation:DescribeStackEvents"
                  - "cloudformation:CreateStack"
                  - "cloudformation:UpdateStack"
                Resource: "*" # TODO scope to specific stacks
        - PolicyName: CodeBuildResourcesAccess
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource:
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*"
              - Effect: Allow
                Action:
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                Resource:
                  - !GetAtt ArtifactStore.Arn
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:PutObjectAcl
                  - s3:GetObject
                  - s3:GetObjectVersion
                Resource:
                  - !Sub ${ArtifactStore.Arn}/*
              - Effect: Allow
                Action:
                  - ecr:GetAuthorizationToken
                Resource: '*' # TODO scope to specific ECR repos
              - Effect: Allow
                Action: codestar-connections:UseConnection
                Resource:
                  - !Sub arn:aws:codestar-connections:us-east-1:${AWS::AccountId}:connection/*
        - PolicyName: CodeBuildSecretsAccess
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - "secretsmanager:GetSecretValue"
                Resource:
                  - !Sub arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:cicd/*
  
  # This role will be used by CodeBuild to verify pull requests. As such it has
  # very limited permissions, as any GitHub user can create a Pull Requests.
  # Since we may want to create multiple codebuild projects for different
  # branches, we can append policies when those stack resources are created
  # (in "2-cicd/cicd.template.yml")
  PublicCodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: ['sts:AssumeRole']
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
        Version: '2012-10-17'
      Path: /service-role/
      Policies:
        - PolicyName: PublicCodeBuildSecretsAccess
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - "secretsmanager:GetSecretValue"
                Resource:
                  - !Sub arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:cicd/docker-hub/username-ITBwTx
                  - !Sub arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:cicd/docker-hub/read-only-token-SsbSj7

  # This would ideally be defined in 3-app/aiproxy/template.yml, but we do
  # not allow the CloudFormationServiceRole permission to CreateRole, so we
  # have to define it here. TODO: Tweak permissions for the role used to create
  # the cloudformation stack.
  ECSTaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: ECRPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ecr:GetAuthorizationToken
                  - ecr:BatchCheckLayerAvailability
                  - ecr:GetDownloadUrlForLayer
                  - ecr:BatchGetImage
                Resource: "*"
        - PolicyName: LogsPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: "*"

Outputs:
  CodeBuildArtifactBucket:
    Description: AiProxy CodeBuild Artifact Bucket Name
    Value: !Ref ArtifactStore
    Export: {Name: AiProxyCodeBuildArtifactBucket}
  CodeBuildRoleArn:
    Description: AiProxy CodeBuild Role ARN
    Value: !GetAtt CodeBuildRole.Arn
    Export: {Name: AiProxyCodeBuildRoleArn}
  CodeBuildRoleName:
    Description: AiProxy CodeBuild Role Name
    Value: !Ref CodeBuildRole
    Export: {Name: AiProxyCodeBuildRoleName}
  PublicCodeBuildRoleArn:
    Description: AiProxy Pull Request CodeBuild Role ARN
    Value: !GetAtt PublicCodeBuildRole.Arn
    Export: {Name: AiProxyPublicCodeBuildRoleArn}
  PublicCodeBuildRoleName:
    Description: AiProxy Pull Request CodeBuild Role Name
    Value: !Ref PublicCodeBuildRole
    Export: {Name: AiProxyPublicCodeBuildRoleName}
  ECSTaskExecutionRoleArn:
    Description: AiProxy ECS Task Execution Role ARN
    Value: !GetAtt ECSTaskExecutionRole.Arn
    Export: {Name: AiProxyECSTaskExecutionRoleArn}