resources.yaml

AWSTemplateFormatVersion: 2010-09-09

Description: >
  Resources set to enable codepipeline execution state to be shown in GitHub

Metadata: {}

Parameters: 
  codepipelineName:
    Type: String
    Description: Name of AWS Codepipeline to track

Mappings: {}

Conditions: {}

Resources:
  pipelineSNSTopicEncryptionKey:
    Type: AWS::KMS::Key
    Properties:
      Description: 
        Fn::Sub: >
          CMK for SNS Topic for encryption at rest in ${AWS::StackName}
      Enabled: True
      EnableKeyRotation: True
      KeyPolicy:
        Version: '2012-10-17'
        Statement:
          - # Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
            Action: kms:*
            Resource: '*'
          - # Allow codestar
            Effect: Allow
            Principal:
              Service: "codestar-notifications.amazonaws.com"
            Action:
              - kms:GenerateDataKey*
              - kms:Decrypt
            Resource: "*"
            Condition:
              StringEquals:
                "kms:ViaService": !Sub 'sns.${AWS::Region}.amazonaws.com'
  
  pipelineNotificationSNSTopic:
    Type: AWS::SNS::Topic
    Properties:
      KmsMasterKeyId: !Ref pipelineSNSTopicEncryptionKey
      Subscription:
        - Endpoint: !GetAtt pipelineNotificationFunction.Arn
          Protocol: "lambda"
  
  pipelineNotificationSNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - # SnsTopicPolicy
            Effect: Allow
            Principal:
              Service: "codestar-notifications.amazonaws.com"
            Action:
              - sns:Publish
            Resource: !Ref pipelineNotificationSNSTopic
      Topics:
        - !Ref pipelineNotificationSNSTopic
  
  lambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: !Sub lambda-${AWS::StackName}
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:*:*:*
              - Effect: Allow
                Action:
                  - codepipeline:GetPipelineExecution
                Resource: !Sub "arn:aws:codepipeline:*:*:${codepipelineName}"
  
  pipelineNotificationRule:
    Type: 'AWS::CodeStarNotifications::NotificationRule'
    Properties:
      Name: !Sub 'Notifications for ${codepipelineName}'
      DetailType: FULL
      Resource: !Sub 'arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${codepipelineName}'
      EventTypeIds:
       - codepipeline-pipeline-pipeline-execution-failed
       - codepipeline-pipeline-pipeline-execution-canceled
       - codepipeline-pipeline-pipeline-execution-started
       - codepipeline-pipeline-pipeline-execution-resumed
       - codepipeline-pipeline-pipeline-execution-succeeded
       - codepipeline-pipeline-pipeline-execution-superseded
      Targets:
        - TargetType: SNS
          TargetAddress: !Ref pipelineNotificationSNSTopic
  
  snsPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt pipelineNotificationFunction.Arn
      Action: lambda:InvokeFunction
      Principal: sns.amazonaws.com
      SourceArn: !Ref pipelineNotificationSNSTopic
  
  pipelineNotificationFunction:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.8
      Handler: index.lambda_handler
      Role: !GetAtt lambdaExecutionRole.Arn
      Timeout: 30
      Environment:
        Variables:
          INTEGRATION_AUTH_TOKEN: "{{resolve:ssm:githubAuthToken}}"
      Code:
        ZipFile: |
          from __future__ import print_function

          import json
          import boto3
          import os
          import urllib3
          from base64 import b64encode

          codepipeline_client = boto3.client('codepipeline')
          integration_token = os.environ['INTEGRATION_AUTH_TOKEN']

          region = os.environ['AWS_REGION']

          def lambda_handler(event, context):
            message = event['Records'][0]['Sns']['Message']
            data = json.loads(message)

            #Push only notifications about Pipeline Execution State Changes
            if data.get("detailType") != "CodePipeline Pipeline Execution State Change":
              return()

            response = codepipeline_client.get_pipeline_execution(
              pipelineName=data['detail']['pipeline'],
              pipelineExecutionId=data['detail']['execution-id']
            )

            short_commit_od = response['pipelineExecution']['artifactRevisions'][0]['revisionId'][0:7]
            commit_id = response['pipelineExecution']['artifactRevisions'][0]['revisionId']
            revision_url = response['pipelineExecution']['artifactRevisions'][0]['revisionUrl']

            if "FullRepositoryId=" in revision_url:
              repo_id = revision_url.split("FullRepositoryId=")[1].split("&")[0]
            else: #gitbub v1 integration
              repo_id = revision_url.split("/")[3] + "/" + revision_url.split("/")[4]

            if data['detail']['state'].upper() in [ "SUCCEEDED" ]:
              state = "success"
            elif data['detail']['state'].upper() in [ "STARTED", "STOPPING", "STOPPED", "SUPERSEDED" ]:
              state = "pending"
            else:
              state = "error"

            url = "https://api.github.com/repos/" + repo_id + "/statuses/" + commit_id

            build_status={}
            build_status['state'] = state
            if data['detail']['state'].upper() in ["FAILED"]:
              build_status['context'] = "CodePipeline: {}".format(data['additionalAttributes']['failedActions'][0]['action'])
            else:
              build_status['context'] = "CodePipeline"
            build_status['description'] = data['detail']['pipeline']
            build_status['target_url'] = "https://" + region + ".console.aws.amazon.com/codesuite/codepipeline/pipelines/" + data['detail']['pipeline'] + "/executions/" + data['detail']['execution-id'] + "?region="+region

            http = urllib3.PoolManager()
            r = http.request('POST', url,
            headers={'Accept': 'application/json', 'Content-Type': 'application/json', 'User-Agent': 'Curl/0.1', 'Authorization' : 'token %s' %  integration_token},
            body=json.dumps(build_status).encode('utf-8')
            )

            return message

Outputs:
  SnsTopicArn:
    Value: !Ref pipelineNotificationSNSTopic