pipeline.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: Deployes a CICD pipeline for the Front End Model and Controller Web solution.

### Prerequisite #####

######## Parameters ############
Parameters:
  pSolutionNaming:
    Type: String

  pGitHubOAuthToken:
    Type: String

  pLocale:
    Type: String
    Default: ""

  pBranchName:
    Type: String
    Description: "The CodeCommit repository branch"
    AllowedValues:
      - master

  pRepositoyName:
    Type: String
    Description: "Name of source code repository in CICD account"

  pSlackChannel:
    Type: String
    Description: "Slack channel to use"

  pSlackURL:
    Type: String
    Description: "Slack URL to use"

  pSlackIcon:
    Type: String
    Description: "Slack icon to use"

########## Stack Resources #########
Resources:
  rArtifactStoreBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${pSolutionNaming}-${pLocale}-pipeline-s3
      AccessControl: BucketOwnerFullControl
      VersioningConfiguration:
        Status: Enabled
    DeletionPolicy: Delete

  rFrontendContentBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: beta.tutorialinaja.tech
      AccessControl: BucketOwnerFullControl
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: index.html
    DeletionPolicy: Delete

  rMediaContentBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: media.tutorialinaja.tech
      AccessControl: BucketOwnerFullControl
    DeletionPolicy: Delete

  rArtifactStoreBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    DependsOn:
      - rCodeBuildRole
      - rCodePipelineRole
      - rCloudFormationRole
    Properties:
      Bucket: !Ref rArtifactStoreBucket
      PolicyDocument:
        Statement:
          - Principal:
              AWS:
                - !GetAtt [rCodeBuildRole, Arn]
                - !GetAtt [rCodePipelineRole, Arn]
                - !GetAtt [rCloudFormationRole, Arn]
            Action: "*"
            Effect: "Allow"
            Resource:
              - !Join ["", ["arn:aws:s3:::", !Ref rArtifactStoreBucket]]
              - !Join ["", ["arn:aws:s3:::", !Ref rArtifactStoreBucket, "/*"]]

  rFrontendContentBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    DependsOn:
      - rCodeBuildRole
      - rCodePipelineRole
      - rCloudFormationRole
    Properties:
      Bucket: !Ref rFrontendContentBucket
      PolicyDocument:
        Statement:
          - Principal: "*"
            Action: "s3:GetObject"
            Effect: "Allow"
            Resource:
              - !Join ["", ["arn:aws:s3:::", !Ref rFrontendContentBucket]]
              - !Join ["", ["arn:aws:s3:::", !Ref rFrontendContentBucket, "/*"]]

  rMediaContentBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    DependsOn:
      - rCodeBuildRole
      - rCodePipelineRole
      - rCloudFormationRole
    Properties:
      Bucket: !Ref rMediaContentBucket
      PolicyDocument:
        Statement:
          - Principal: "*"
            Action: "s3:GetObject"
            Effect: "Allow"
            Resource:
              - !Join ["", ["arn:aws:s3:::", !Ref rMediaContentBucket]]
              - !Join ["", ["arn:aws:s3:::", !Ref rMediaContentBucket, "/*"]]

  rCodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${pSolutionNaming}-cicd-cb-iam-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: Allow
          Principal:
            Service: codebuild.amazonaws.com
          Action: sts:AssumeRole
      Path: "/service/"

  rCodeBuildRolePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub ${pSolutionNaming}-cicd-cb-iam-policy
      Path: "/service/"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action:
              - logs:DescribeLogGroups
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
              - logs:DeleteLogGroup
              - s3:ListBucket*
              - s3:ListAllMyBuckets
              - s3:GetBucketLocation
            Resource: "*"
          - Effect: "Allow"
            Action:
              - codecommit:GitPull
            Resource: "*"
          - Effect: "Allow"
            Action:
              - s3:*
            Resource: "*"
          - Effect: "Allow"
            Action:
              - cloudformation:ValidateTemplate
            Resource: "*"
      Roles:
        - !Ref rCodeBuildRole

  rCodePipelineRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${pSolutionNaming}-cicd-cp-iam-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: codepipeline.amazonaws.com
            Action: sts:AssumeRole
      Path: "/service/"

  rCodePipelineRolePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub ${pSolutionNaming}-cicd-cp-iam-policy
      Path: "/service/"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action:
              - iam:PassRole
              - iam:ListRoles
              - s3:ListAllMyBuckets
              - s3:GetBucketLocation
            Resource: "*"
          - Effect: "Allow"
            Action:
              - codedeploy:CreateDeployment
              - codedeploy:GetApplicationRevision
              - codedeploy:GetDeployment
              - codedeploy:GetDeploymentConfig
              - codedeploy:RegisterApplicationRevision
            Resource: "*"
          - Effect: "Allow"
            Action:
              - sts:AssumeRole
            Resource:
              - !GetAtt [rCloudFormationRole, Arn]
          - Effect: "Allow"
            Action:
              - codecommit:*
            Resource:
              Fn::Join:
                - ":"
                - - "arn:aws:codecommit"
                  - Ref: "AWS::Region"
                  - Ref: "AWS::AccountId"
                  - !Sub ${pRepositoyName}
          - Effect: "Allow"
            Action:
              - cloudformation:*
            Resource:
              Fn::Join:
                - ":"
                - - "arn:aws:cloudformation"
                  - Ref: "AWS::Region"
                  - Ref: "AWS::AccountId"
                  - !Sub stack/${pSolutionNaming}*
          - Effect: "Allow"
            Action:
              - codebuild:StartBuild
              - codebuild:BatchGetBuilds
            Resource:
              - !GetAtt [rCodeBuildCICD, Arn]
              - !GetAtt [rCodeCleanupCICD, Arn]
          - Effect: "Allow"
            Action:
              - s3:*
            Resource: "*"
      Roles:
        - !Ref rCodePipelineRole

  rCloudFormationRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${pSolutionNaming}-cicd-cf-iam-role
      Path: "/service/"
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - cloudformation.amazonaws.com
                - lambda.amazonaws.com
                - cloudwatch.amazonaws.com
                - apigateway.amazonaws.com
          - Effect: Allow
            Principal:
              AWS:
                - !GetAtt [rCodePipelineRole, Arn]
            Action:
              - sts:AssumeRole

  rCloudFormationRolePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub ${pSolutionNaming}-cicd-cf-iam-policy
      Path: "/service/"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action: "*"
            Resource: "*"
      Roles:
        - !Ref rCloudFormationRole

  rCodePipelineStack:
    Type: AWS::CodePipeline::Pipeline
    DependsOn:
      - rCodeBuildCICD
      - rCodePipelineRolePolicy
    Properties:
      Name: !Sub ${pSolutionNaming}-cicd-pl
      RestartExecutionOnUpdate: True
      RoleArn: !GetAtt [rCodePipelineRole, Arn]
      ArtifactStore:
        Location:
          Ref: rArtifactStoreBucket
        Type: S3
      Stages:
        - Name: source
          Actions:
            - InputArtifacts: []
              Name: source
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: 1
                Provider: GitHub
              OutputArtifacts:
                - Name: SourceOutput
              Configuration:
                Owner: pojok-projects
                Repo: !Sub ${pRepositoyName}
                Branch: !Sub ${pBranchName}
                PollForSourceChanges: false
                OAuthToken: !Ref pGitHubOAuthToken
              RunOrder: 1
        - Name: build
          Actions:
            - Name: build
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref rCodeBuildCICD
              RunOrder: 1
              InputArtifacts:
                - Name: SourceOutput
              OutputArtifacts:
                - Name: BuildCICDOutput
        - Name: deploy
          Actions:
            - Name: deploy-to-s3
              RoleArn: !GetAtt [rCloudFormationRole, Arn]
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: S3
              Configuration:
                Extract: true
                BucketName: !Ref rFrontendContentBucket
              InputArtifacts:
                - Name: BuildCICDOutput
              RunOrder: 1
            - Name: cleanup-old-files
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref rCodeCleanupCICD
              RunOrder: 2
              InputArtifacts:
                - Name: BuildCICDOutput
              OutputArtifacts:
                - Name: BuildCICDCleanup

  rGithubWebhook:
    Type: AWS::CodePipeline::Webhook
    Properties:
      Authentication: GITHUB_HMAC
      AuthenticationConfiguration:
        SecretToken: !Ref pGitHubOAuthToken
      RegisterWithThirdParty: "true"
      Filters:
        - JsonPath: "$.ref"
          MatchEquals: refs/heads/{Branch}
      TargetPipeline: !Ref rCodePipelineStack
      TargetAction: source
      TargetPipelineVersion: !GetAtt rCodePipelineStack.Version

  rCodeBuildCICD:
    Type: AWS::CodeBuild::Project
    DependsOn:
      - rCodeBuildRole
      - rArtifactStoreBucket
    Properties:
      Name: !Sub ${pSolutionNaming}-cicd-package-cb
      Description: "Package artifact for CICD Pipeline"
      ServiceRole: !GetAtt [rCodeBuildRole, Arn]
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        Type: linuxContainer
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:2.0
        EnvironmentVariables:
          - Name: FrontendContentBucket
            Value: !Ref rFrontendContentBucket
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                nodejs: 10
            build:
              commands:
                - set -ex
                - printenv
                - ls -R
                - npm install
                - npm run build
          artifacts:
            files: "**/*"
            base-directory: build
      TimeoutInMinutes: 10
      Tags:
        - Key: Name
          Value: !Sub ${pSolutionNaming}-cicd-package-cb

  rCodeCleanupCICD:
    Type: AWS::CodeBuild::Project
    DependsOn:
      - rCodeBuildRole
      - rArtifactStoreBucket
    Properties:
      Name: !Sub ${pSolutionNaming}-cicd-cleanup-cb
      Description: "Package artifact for CICD Pipeline"
      ServiceRole: !GetAtt [rCodeBuildRole, Arn]
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        Type: linuxContainer
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:2.0
        EnvironmentVariables:
          - Name: FrontendContentBucket
            Value: !Ref rFrontendContentBucket
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                nodejs: 10
            build:
              commands:
                - set -ex
                - printenv
                - ls -R
                - aws s3 sync . "s3://${FrontendContentBucket}" --delete
          artifacts:
            files: "**/*"
      TimeoutInMinutes: 10
      Tags:
        - Key: Name
          Value: !Sub ${pSolutionNaming}-cicd-artifact-cb

Outputs:
  CodePipelineURL:
    Description: CodePipeline URL
    Value:
      Fn::Join:
        - ""
        - - "https://console.aws.amazon.com/codepipeline/home?region="
          - Ref: AWS::Region
          - "#/view/"
          - Ref: rCodePipelineStack