pipeformation.template.yaml

AWSTemplateFormatVersion: "2010-09-09"


Description: "Pipeline configuration to deploy CloudFormation templates from
              Github to single account. Stack name max 32 characters."


Parameters:
  ParamGithubAccount:
    Type: String
    Description: GitHub account hosting the source repository for the pipeline.
  ParamGithubRepo:
    Type: String
    Description: GitHub repository that serves as the source for the pipeline.
  ParamGithubBranch:
    Type: String
    Default: main
    Description: GitHub branch to serve as the source for the pipeline
  ParamStackName:
    Type: String
    Description: Name of Stack to be updated.
  ParamTemplateFile:
    Type: String
    Description: "Name of CloudFormation template file in the repository
                 to use for updating stack."
  ParamConfigFile:
    Type: String
    Description: "(Optional) Name of the CloudFormation configuration file (json)
                  containing the parameter values to use for updating stack."
  ParamApprovalStage:
    Type: String
    AllowedValues:
      - true
      - false
    Description: Inserts an approval stage before executing the change set.
    Default: true
  ParamDetectChanges:
    Type: String
    AllowedValues:
      - true
      - false
    Description: "Determines whether the pipeline will automatically
                  be started on a commit to the git branch and repo specified.
                  If set to 'true', the pipeline starts automatically when
                  the commit is made.
                  If set to 'false', the pipeline only runs if it is
                  started manually."
    Default: false
  ParamBuildStage:
    Type: String
    AllowedValues:
      - true
      - false
    Description: "Determines whether a build stage will be included in the pipeline.
                  This will run the aws cloudformation package command for packaging
                  local artifacts that the CloudFormation template references.
                  This is required where the template includes a Transform section,
                  for example, where serverless resources are included.
                  Set to 'true' to include a build stage.
                  Set to 'false' to not include a build stage."
    Default: true


Conditions:
  CondApprovalStage: !Equals
    - !Ref ParamApprovalStage
    - true
  CondConfigFile: !Not
    - !Equals
      - !Ref ParamConfigFile
      - ''
  CondDetectChanges:
    !Equals
      - !Ref ParamDetectChanges
      - true
  CondBuildStage:
    !Equals
      - !Ref ParamBuildStage
      - true

Resources:
  IAMRoleCodeBuildProject:
    Type: AWS::IAM::Role
    Condition: CondBuildStage
    Properties:
      Policies:
        -
          PolicyName: ArtifactBucketObjects
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                Resource:
                  - Fn::Join: ['',['arn:aws:s3:::',!Ref S3BucketArtifactStore,'/*']]
        -
          PolicyName: CWLogStream
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*
        -
          PolicyName: CWLogGroup
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                Resource:
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*
        -
          PolicyName: ArtifactBucket
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action:
                  - s3:GetBucketAcl
                  - s3:GetBucketLocation
                Resource:
                  - Fn::Join: ['',['arn:aws:s3:::',!Ref S3BucketArtifactStore]]

      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action: sts:AssumeRole
  IAMRoleCodePipelinePipeline:
    Type: AWS::IAM::Role
    Properties:
      Policies:
        -
          PolicyName: IAMPass
          PolicyDocument:
            Statement:
              -
                Effect: Allow
                Action: iam:PassRole
                Resource: !GetAtt IAMRoleCloudformation.Arn
            Version: 2012-10-17
        -
          PolicyName: Codestar
          PolicyDocument:
            Statement:
              -
                Effect: Allow
                Action: codestar-connections:UseConnection
                Resource: !Ref CodeStarConnectionsConnectionGitHub
            Version: 2012-10-17
        -
          !If
            - CondBuildStage
            - PolicyName: CodeBuild
              PolicyDocument:
                Statement:
                  -
                    Effect: Allow
                    Action:
                      - codebuild:BatchGetBuilds
                      - codebuild:StartBuild
                      - codebuild:BatchGetBuildBatches
                      - codebuild:StartBuildBatch
                    Resource: !GetAtt CodeBuildProject.Arn
                Version: 2012-10-17
            - !Ref AWS::NoValue
        -
          PolicyName: Cloudformation
          PolicyDocument:
            Statement:
              -
                Effect: Allow
                Action:
                  - cloudformation:DescribeStacks
                  - cloudformation:UpdateStack
                  - cloudformation:CreateChangeSet
                  - cloudformation:DeleteChangeSet
                  - cloudformation:DescribeChangeSet
                  - cloudformation:ExecuteChangeSet
                Resource:
                  - !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}/*
                  - !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${ParamStackName}/*
            Version: 2012-10-17
        -
          PolicyName: S3BucketAccess
          PolicyDocument:
            Statement:
              -
                Effect: Allow
                Action:
                  - s3:ListBucket
                  - s3:GetBucketPolicy
                  - s3:GetBucketLocation
                Resource:
                  - Fn::Join: ['',['arn:aws:s3:::',!Ref S3BucketArtifactStore]]
            Version: 2012-10-17
        -
          PolicyName: S3ObjectAccess
          PolicyDocument:
            Statement:
              -
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:PutObjectACL
                  - s3:GetObjectACL
                Resource:
                  - Fn::Join: ['',['arn:aws:s3:::',!Ref S3BucketArtifactStore, '/*']]
            Version: 2012-10-17
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
            Action:
              - sts:AssumeRole
  IAMRoleCloudformation:
    Type: AWS::IAM::Role
    Properties:
      Policies:
        -
          PolicyName: CloudformationStackDeployments
          PolicyDocument:
            Statement:
              -
                Effect: Allow
                Action:
                  - cloudformation:*
                  - ec2:*
                  - iam:CreateRole
                  - iam:CreatePolicy
                  - iam:GetRole
                  - iam:DeleteRole
                  - iam:PutRolePolicy
                  - iam:DeleteRolePolicy
                  - s3:*
                  - lambda:*
                  - sqs:*
                  - dynamodb:*
                  - iam:*
                  - logs:*
                  - cloudwatch:*
                  - events:*
                  - codestar-connections:PassConnection
                  - ssm:*
                  - apigateway:*
                Resource: "*"
            Version: 2012-10-17
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - cloudformation.amazonaws.com
            Action:
              - sts:AssumeRole
  S3BucketArtifactStore:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      BucketEncryption:
          ServerSideEncryptionConfiguration:
              -   ServerSideEncryptionByDefault:
                      SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: "Enabled"
      LifecycleConfiguration:
        Rules:
          -
            Status: "Enabled"
            ExpirationInDays: 30
            Id: Remove after 30 days
            NoncurrentVersionExpirationInDays: 30
  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Condition: CondBuildStage
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      ConcurrentBuildLimit: 1
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        EnvironmentVariables:
          -
            Name: S3_BUCKET_ARTIFACT_STORE
            Value: !Ref S3BucketArtifactStore
          -
            Name: CFN_TEMPLATE
            Value: !Ref ParamTemplateFile
        Image: aws/codebuild/standard:5.0
        Type: LINUX_CONTAINER
      LogsConfig:
        CloudWatchLogs:
          Status: ENABLED
      QueuedTimeoutInMinutes: 5
      ResourceAccessRole: !GetAtt IAMRoleCodeBuildProject.Arn
      ServiceRole: !GetAtt IAMRoleCodeBuildProject.Arn
      Source:
        BuildSpec:  |
          version: 0.2
          phases:
            install:
              commands:
                - printenv
                - ls -R
            build:
              commands:
                - aws cloudformation package --template-file $CFN_TEMPLATE --s3-bucket $S3_BUCKET_ARTIFACT_STORE --output-template-file $CFN_TEMPLATE
                - ls -R
          artifacts:
            files:
              - '**/*'
            discard-paths: no
        Type: CODEPIPELINE
      TimeoutInMinutes: 5
  CodeStarConnectionsConnectionGitHub:
    Type: AWS::CodeStarConnections::Connection
    Properties:
      ConnectionName: !Ref AWS::StackName
      ProviderType: GitHub
  CodePipelinePipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
        ArtifactStore:
          Location: !Ref S3BucketArtifactStore
          Type: S3
        RestartExecutionOnUpdate: false
        RoleArn: !GetAtt IAMRoleCodePipelinePipeline.Arn
        Stages:
          -
            Name: SourceStage
            Actions:
              -
                ActionTypeId:
                  Category: Source
                  Owner: AWS
                  Provider: CodeStarSourceConnection
                  Version: 1
                Configuration:
                  ConnectionArn: !Ref CodeStarConnectionsConnectionGitHub
                  FullRepositoryId: !Sub "${ParamGithubAccount}/${ParamGithubRepo}"
                  BranchName: !Ref ParamGithubBranch
                  DetectChanges:
                    !If
                      - CondDetectChanges
                      - true
                      - false
                Name: SourceAction
                OutputArtifacts:
                  - Name: SourceActionOutput
                RunOrder: 1
          -
            !If
              - CondBuildStage
              - Name: BuildStage
                Actions:
                  -
                    ActionTypeId:
                      Category: Build
                      Owner: AWS
                      Provider: CodeBuild
                      Version: 1
                    Configuration:
                        ProjectName: !Ref CodeBuildProject
                    InputArtifacts:
                      - Name: SourceActionOutput
                    Name: BuildAction
                    OutputArtifacts:
                      - Name: BuildActionOutput
                    #RoleArn: !GetAtt IAMRoleCodePipelinePipeline.Arn
                    RunOrder: 1
              - !Ref AWS::NoValue
          -
            Name: CreateChangeSetDeployStage
            Actions:
              -
                ActionTypeId:
                  Category: Deploy
                  Owner: AWS
                  Provider: CloudFormation
                  Version: 1
                Configuration:
                  ActionMode: CHANGE_SET_REPLACE
                  StackName: !Ref ParamStackName
                  Capabilities: CAPABILITY_IAM,CAPABILITY_AUTO_EXPAND
                  ChangeSetName: !Sub ${ParamStackName}-ChangeSet
                  RoleArn: !GetAtt IAMRoleCloudformation.Arn
                  TemplatePath: !Sub "BuildActionOutput::${ParamTemplateFile}"
                  TemplateConfiguration: !Sub "BuildActionOutput::${ParamConfigFile}"
                InputArtifacts:
                  !If
                    - CondBuildStage
                    - - Name: BuildActionOutput
                    - - Name: SourceActionOutput
                Name: CreateChangeSetAction
                OutputArtifacts:
                  - Name: CreateChangeSetActionOutput
                RunOrder: 1
          -
            !If
              - CondApprovalStage
              - Name: ChangeSetApprovalStage
                Actions:
                  -
                    ActionTypeId:
                      Category: Approval
                      Owner: AWS
                      Provider: Manual
                      Version: 1
                    Configuration:
                      CustomData: Please approve the change set.
                    RunOrder: 1
                    Name: ChangeSetApprovalStageAction
              - !Ref "AWS::NoValue"
          -
            Name: ExecuteChangeSetDeployStage
            Actions:
              -
                ActionTypeId:
                  Category: Deploy
                  Owner: AWS
                  Provider: CloudFormation
                  Version: 1
                Configuration:
                  ActionMode: CHANGE_SET_EXECUTE
                  StackName: !Ref ParamStackName
                  Capabilities: CAPABILITY_IAM,CAPABILITY_AUTO_EXPAND
                  ChangeSetName: !Sub ${ParamStackName}-ChangeSet
                InputArtifacts:
                  - Name: CreateChangeSetActionOutput
                Name: ExecuteChangeSetAction
                RunOrder: 1