cf-app-pipeline.yaml

AWSTemplateFormatVersion: 2010-09-09

Description: >
  This template shows how to use AWS CodePipeline and AWS CodeBuild to build an
  automated continuous deployment pipeline to Amazon Elastic Container Service
  (Amazon ECS) using clusters powered by AWS Fargate or Amazon Elastic Compute
  Cloud (Amazon EC2).

Parameters:
  EnvType:
    Description: Environment type.
    Default: dev
    Type: String
    AllowedValues: [prod, dev]
    ConstraintDescription: must specify prod or dev.

  GitHubUser:
    Type: String

  GitHubRepo:
    Type: String

  GitHubBranch:
    Type: String

  GitHubToken:
    Type: String
    NoEcho: true

  CodePipelineName:
    Type: String

  S3CodePipelineBucketName:
    Type: String

  CodeBuildSpecFileName:
    Type: String

  Cluster:
    Type: String

  Service:
    Type: String

  ImageRepoLaravel:
    Description: ECR Repositories Name for Laravel
    Type: String

  ImageRepoNginx:
    Description: ECR Repositories Name for Nginx web server
    Type: String

Conditions:
  CreateProdResources: !Equals [!Ref EnvType, prod]
  CreateDevResources: !Equals [!Ref EnvType, dev]

Resources:

  CodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource: "*"
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - ecr:GetAuthorizationToken
              - Resource: !Sub arn:aws:s3:::${ArtifactBucket}/*
                Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:GetObjectVersion
              - Resource: !Sub arn:aws:ecr:${AWS::Region}:${AWS::AccountId}:repository/${ImageRepoNginx}
                Effect: Allow
                Action:
                  - ecr:GetDownloadUrlForLayer
                  - ecr:BatchGetImage
                  - ecr:BatchCheckLayerAvailability
                  - ecr:PutImage
                  - ecr:InitiateLayerUpload
                  - ecr:UploadLayerPart
                  - ecr:CompleteLayerUpload
              - Resource: !Sub arn:aws:ecr:${AWS::Region}:${AWS::AccountId}:repository/${ImageRepoLaravel}
                Effect: Allow
                Action:
                  - ecr:GetDownloadUrlForLayer
                  - ecr:BatchGetImage
                  - ecr:BatchCheckLayerAvailability
                  - ecr:PutImage
                  - ecr:InitiateLayerUpload
                  - ecr:UploadLayerPart
                  - ecr:CompleteLayerUpload

  CodePipelineServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codepipeline.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource:
                  - !Sub arn:aws:s3:::${ArtifactBucket}/*
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
              - Resource: "*"
                Effect: Allow
                Action:
                  - ecs:DescribeServices
                  - ecs:DescribeTaskDefinition
                  - ecs:DescribeTasks
                  - ecs:ListTasks
                  - ecs:RegisterTaskDefinition
                  - ecs:UpdateService
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds
                  - iam:PassRole

  ArtifactBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref 'S3CodePipelineBucketName'
    # DeletionPolicy: Retain

  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Cache: 
        Location: LOCAL
        Modes: 
        - LOCAL_SOURCE_CACHE
        - LOCAL_DOCKER_LAYER_CACHE
        Type: LOCAL
      Source:
        Type: CODEPIPELINE
        BuildSpec: !Ref CodeBuildSpecFileName
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/docker:17.09.0
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: AWS_DEFAULT_REGION
            Value: !Ref AWS::Region
          - Name: ACCOUNT_ID
            Value: !Ref AWS::AccountId
          - Name: BUILD_ENV
            Value: !If [CreateProdResources, 'prod', 'dev']
          - Name: LARAVEL_REPOSITORY_NAME
            Value: !Ref ImageRepoLaravel
          - Name: NGINX_REPOSITORY_NAME
            Value: !Ref ImageRepoNginx
      Name: !Ref AWS::StackName
      ServiceRole: !Ref CodeBuildServiceRole

  CFPipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Name: !Ref 'CodePipelineName'
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactBucket
      Stages:
        - Name: Source
          Actions:
            - Name: App
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: 1
                Provider: GitHub
              Configuration:
                Owner: !Ref GitHubUser
                Repo: !Ref GitHubRepo
                Branch: !Ref GitHubBranch
                OAuthToken: !Ref GitHubToken
              OutputArtifacts:
                - Name: App
              RunOrder: 1
        - Name: Build
          Actions:
            - Name: Build
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref CodeBuildProject
              InputArtifacts:
                - Name: App
              OutputArtifacts:
                - Name: BuildOutput
              RunOrder: 1
        - Name: Deploy
          Actions:
            - Name: Deploy
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: ECS
              Configuration:
                ClusterName: !Ref Cluster
                ServiceName: !Ref Service
                FileName: imagedefinitions.json
              InputArtifacts:
                - Name: BuildOutput
              RunOrder: 1

Outputs:
  PipelineUrl:
    Value: !Sub https://console.aws.amazon.com/codepipeline/home?region=${AWS::Region}#/view/${CFPipeline}