awsms-poc-code-pipeline.yml

AWSTemplateFormatVersion: 2010-09-09
Parameters:
  GitHubRepo:
    Type: String
    Description: "GitHubRepo"
    Default: sknampally/awsms-poc-springboot
  GitHubBranch:
    Type: String
    Description: "GitHubBranch"
    AllowedValues:
      - master
    Default: master
  GitHubToken:
    Type: String
    NoEcho: true
  GitHubUser:
    Type: String
  Cluster:
    Type: String
    Default: sandbox-AWSMS-POC-cluster
  Service:
    Type: String
    Default: test-awsms-poc
  PublicSubnetOne:
    Type: AWS::EC2::Subnet::Id
  PublicSubnetTwo:
    Type: AWS::EC2::Subnet::Id
  VpcId:
    Type: AWS::EC2::VPC::Id
  VpcCIDR:
    Type: String
  TemplateBucket:
    Type: String
Resources:
  Repository:
    Type: AWS::ECR::Repository
    DeletionPolicy: Retain
    Properties:
      RepositoryName: !Ref AWS::StackName
  CloudFormationExecutionRole:
    Type: AWS::IAM::Role
    DeletionPolicy: Retain
    Properties:
      #RoleName: !Sub cfn-${AWS::StackName}
      Path: /
      AssumeRolePolicyDocument: |
        {
            "Statement": [{
                "Effect": "Allow",
                "Principal": { "Service": [ "cloudformation.amazonaws.com" ]},
                "Action": [ "sts:AssumeRole" ]
            }]
        }
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource: "*"
                Effect: Allow
                Action:
                  - ecs:*
                  - ecr:*
                  - iam:*
                  - ec2:*
                  - elasticloadbalancing:*
                  - autoscaling:*
  ArtifactBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
  CodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      ManagedPolicyArns:
          - "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess"
          - "arn:aws:iam::aws:policy/AdministratorAccess"
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource: "*"
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - ecr:GetAuthorizationToken
              - Resource: !Sub arn:aws:s3:::${ArtifactBucket}/*
                Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:GetObjectVersion
              - Resource: "*"
                Effect: Allow
                Action:
                  - "ecr:GetAuthorizationToken"
                  - "ecr:BatchCheckLayerAvailability"
                  - "ecr:GetDownloadUrlForLayer"
                  - "ecr:GetRepositoryPolicy"
                  - "ecr:DescribeRepositories"
                  - "ecr:ListImages"
                  - "ecr:DescribeImages"
                  - "ecr:BatchGetImage"
                  - "ecr:GetLifecyclePolicy"
                  - "ecr:GetLifecyclePolicyPreview"
                  - "ecr:ListTagsForResource"
                  - "ecr:DescribeImageScanFindings"
                  - "ecr:InitiateLayerUpload"
                  - "ecr:UploadLayerPart"
                  - "ecr:CompleteLayerUpload"
                  - "ecr:PutImage"
              - Resource: "*"
                Effect: Allow
                Action:
                   - "ecr:*"
                   - "cloudtrail:LookupEvents"
                Resource: arn:aws:logs:us-west-2:160357565307:log-group:/aws/codebuild/Sample-CodeBuildProject
  CodePipelineServiceRole:
    Type: AWS::IAM::Role
    Properties:
      #RoleName: !Sub cp-${AWS::StackName}
      Path: /
      AssumeRolePolicyDocument: |
        {
            "Statement": [{
                "Effect": "Allow",
                "Principal": { "Service": [ "codepipeline.amazonaws.com" ]},
                "Action": [ "sts:AssumeRole" ]
            }]
        }
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEC2ContainerServiceFullAccess
        - arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource:
                  - !Sub arn:aws:s3:::${ArtifactBucket}/*
                  - !Sub arn:aws:s3:::${TemplateBucket}
                  - !Sub arn:aws:s3:::${TemplateBucket}/*
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
              - Resource: "*"
                Effect: Allow
                Action:
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds
                  - cloudformation:*
                  - lambda:*
                  - iam:PassRole
  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: Sample-CodeBuildProject
      ServiceRole: !GetAtt CodeBuildServiceRole.Arn
      Artifacts:
        Type: no_artifacts
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:2.0
        PrivilegedMode: true
      Source:
        Auth:
          Type: OAUTH
        Location: https://github.com/sknampally/awsms-poc-springboot.git
        Type: GITHUB
      Triggers:
        Webhook: true
      TimeoutInMinutes: 10
  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Name: github-events-pipeline
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactBucket
      Stages:
        - Name: Source
          Actions:
            - Name: App
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: 1
                Provider: GitHub
              Configuration:
                Owner: !Ref GitHubUser
                Repo: !Ref GitHubRepo
                Branch: !Ref GitHubBranch
                OAuthToken: !Ref GitHubToken
              OutputArtifacts:
                - Name: App
              RunOrder: 1
        - Name: Build
          Actions:
            - Name: Build
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref CodeBuildProject
              InputArtifacts:
                - Name: App
              OutputArtifacts:
                - Name: BuildOutput
              RunOrder: 1
        - Name: Deploy
          Actions:
            - Name: Deploy
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: ECS
              Configuration:
                ClusterName: !Ref Cluster
                ServiceName: !Ref Service
                FileName: images.json
              InputArtifacts:
                - Name: BuildOutput
              RunOrder: 1
Outputs:
  PipelineUrl:
    Value: !Sub https://console.aws.amazon.com/codepipeline/home?region=${AWS::Region}#/view/${Pipeline}