build.yaml

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31

Metadata:
  # Documentation for the AWS console
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label: Source Location
        Parameters:
          - Owner
          - Repo
          - AccessToken
          - Branch
      - Label: Task Runner
        Parameters:
          - AccessKeyID
          - SecretAccessKey
    ParameterLabels:
      Owner:
        default: GitHub repository owner
      Repo:
        default: GitHub or CodeCommit repository name
      AccessToken:
        default: GitHub OAuth access token
      Branch:
        default: Branch to build
      AccessKeyID:
        default: AWS Access Key ID
      SecretAccessKey:
        default: AWS Secret Access Key

Parameters:
  Branch:
    Type: String
    Default: master
    Description: The branch of the source repository to build
  Owner:
    Type: String
    Description: The owner of the GitHub repository (if using GitHub.)
    Default: ''
  Repo:
    Type: String
    Description: The name of the repository.  If using CodeCommit, this is the name of the created repository.
    Default: ''
  AccessToken:
    Type: String
    Description: The GitHub token to use to fetch source code (if using GitHub.)
    Default: ''
    NoEcho: true
  AccessKeyID:
    Type: String
    Description: The AWS Access Key ID to use for the Data Pipeline Task Runner
    Default: ''
  SecretAccessKey:
    Type: String
    Description: The AWS Secret Access Key to use for the Data Pipeline Task Runner
    Default: ''
    NoEcho: true

Conditions:
  RepoNameGiven: !Not [!Equals [!Ref Repo, ""]]
  UseGitHub: !And
    - !Not [!Equals [!Ref Owner, ""]]
    - !Not [!Equals [!Ref Repo, ""]]
    - !Not [!Equals [!Ref AccessToken, ""]]
  UseCodeCommit: !Or
    - !Equals [!Ref Owner, ""]
    - !Equals [!Ref Repo, ""]
    - !Equals [!Ref AccessToken, ""]

Outputs:
  RepoURL:
    Value: !If
      - UseGitHub
      - !Sub "https://github.com/${Owner}/${Repo}"
      - !GetAtt Repository.CloneUrlHttp
    Description: The HTTP URL for the source repository.

Resources:
  # A IAM Role for deploying the pipeline.
  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - !Sub "cloudformation.${AWS::URLSuffix}"
                - !Sub "logs.${AWS::Region}.${AWS::URLSuffix}"
                - !Sub "events.${AWS::URLSuffix}"
                - !Sub "codecommit.${AWS::URLSuffix}"
                - !Sub "codebuild.${AWS::URLSuffix}"
                - !Sub "codedeploy.${AWS::URLSuffix}"
                - !Sub "codepipeline.${AWS::URLSuffix}"
                - !Sub "cloudfront.${AWS::URLSuffix}"
                - !Sub "s3.${AWS::URLSuffix}"
                - !Sub "apigateway.${AWS::URLSuffix}"
                - !Sub "lambda.${AWS::URLSuffix}"
                - !Sub "dynamodb.${AWS::URLSuffix}"
                - !Sub "kinesis.${AWS::URLSuffix}"
                - !Sub "ssm.${AWS::URLSuffix}"
                - !Sub "route53.${AWS::URLSuffix}"
                - !Sub "acm.${AWS::URLSuffix}"
                - !Sub "firehose.${AWS::URLSuffix}"
                - !Sub "elasticmapreduce.${AWS::URLSuffix}"
                - !Sub "redshift.${AWS::URLSuffix}"
                - !Sub "ec2.${AWS::URLSuffix}"
                - !Sub "datapipeline.${AWS::URLSuffix}"
                - !Sub "serverlessrepo.${AWS::URLSuffix}"
      Policies:
        - PolicyName: Bootstrap
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - cloudformation:*
                  - codecommit:*
                  - codebuild:*
                  - codedeploy:*
                  - codepipeline:*
                  - cloudfront:*
                  - events:*
                  - iam:*
                  - logs:*
                  - apigateway:*
                  - lambda:*
                  - dynamodb:*
                  - kinesis:*
                  - s3:*
                  - ssm:*
                  - route53:*
                  - acm:*
                  - firehose:*
                  - elasticmapreduce:*
                  - redshift:*
                  - ec2:*
                  - datapipeline:*
                  - serverlessrepo:*
                  - glue:*
                  - kinesisanalytics:*
                  - cloudwatch:*
                  - iam:PassRole
                Effect: Allow
                Resource: "*"

  # A S3 Bucket to hold the build artifacts and deploy the pipeline from.
  #
  # Versioning must be enabled for CodePipeline and friends to use.  The bucket
  # is retained on delete to make the stack easier to delete.
  Bucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
      VersioningConfiguration:
        Status: Enabled

  # A CodeCommit repository to hold the source code.
  #
  # This could be replaced in the build (below) with a GitHub repository, but
  # that requires a manual step of creating a access token.
  Repository:
    Type: AWS::CodeCommit::Repository
    Condition: UseCodeCommit
    DeletionPolicy: Retain
    Properties:
      RepositoryName: !If
        - RepoNameGiven
        - !Ref Repo
        - !Ref AWS::StackName

  # A CodePipeline pipeline to build and deploy the data pipeline.
  #
  # It fetches the source, builds, tests, and packages all of the lambdas,
  # packages and uploads the lambdas and CloudFormation template, then
  # continuously deploys it.
  #
  # The target stack's name is the current stack name with the suffix "-prod" to
  # avoid name conflicts.
  Build:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub "${AWS::StackName}-build"
      ServiceRole: !Ref Role
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:2.0
        EnvironmentVariables:
          - Type: PLAINTEXT
            Name: BUCKET
            Value: !Ref Bucket
          - Type: PLAINTEXT
            Name: BRANCH
            Value: !Ref Branch
          - Type: PLAINTEXT
            Name: GO111MODULE
            Value: "on"
          - Type: PLAINTEXT
            Name: ACCESS_KEY_ID
            Value: !Ref AccessKeyID
          - Type: PLAINTEXT
            Name: SECRET_ACCESS_KEY
            Value: !Ref SecretAccessKey
      Source:
        Type: CODEPIPELINE
      Artifacts:
        Type: CODEPIPELINE

  # A CI/CD pipeline for the data pipeline.  Continuously deploys the data
  # pipeline to a stack named "<build-stack-name>-prod".
  #
  # This fetches the code, uses the build job to build and upload the package,
  # then deploys the stack using CloudFormation using a change set.
  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt Role.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref Bucket
      Stages:
        - Name: Source
          Actions:
            - Name: Fetch
              RunOrder: 1
              ActionTypeId:
                Category: Source
                Owner: !If [UseGitHub, ThirdParty, AWS]
                Provider: !If [UseGitHub, GitHub, CodeCommit]
                Version: "1"
              Configuration: !If
                - UseGitHub
                - Owner: !Ref Owner
                  Repo: !Ref Repo
                  OAuthToken: !Ref AccessToken
                  Branch: !Ref Branch
                - RepositoryName: !GetAtt Repository.Name
                  BranchName: !Ref Branch
              OutputArtifacts:
                - Name: Source
        - Name: Build
          Actions:
            - Name: Build
              RunOrder: 1
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: "1"
              Configuration:
                ProjectName: !Ref Build
              InputArtifacts:
                - Name: Source
              OutputArtifacts:
                - Name: Package
        - Name: Deploy
          Actions:
            - Name: CreateChangeSet
              RunOrder: 1
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_REPLACE
                RoleArn: !GetAtt Role.Arn
                StackName: !Sub "${AWS::StackName}-${Branch}"
                ChangeSetName: !Sub "${AWS::StackName}-${Branch}-change-set"
                TemplatePath: Package::template.yaml
                TemplateConfiguration: Package::template-config.json
                Capabilities: CAPABILITY_IAM,CAPABILITY_NAMED_IAM,CAPABILITY_AUTO_EXPAND
              InputArtifacts:
                - Name: Package
            - Name: ExecuteChangeSet
              RunOrder: 2
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                RoleArn: !GetAtt Role.Arn
                StackName: !Sub "${AWS::StackName}-${Branch}"
                ChangeSetName: !Sub "${AWS::StackName}-${Branch}-change-set"
                Capabilities: CAPABILITY_IAM,CAPABILITY_NAMED_IAM,CAPABILITY_AUTO_EXPAND

  # TODO
  #################
  # Set up a CloudFront-cached static site behind Route53 DNS.
  #
  # Copied/pasted from an external source.  Not integrated yet.
  #################
  #
  # Certificate:
  #   Type: AWS::CertificateManager::Certificate
  #   Conditional: DNSEnabled
  #   Properties:
  #     DomainName: !Ref DNSName
  #     DomainValidationOptions:
  #     - DomainName: !Ref DNSName
  #       ValidationDomain: !Ref DNSName
  #
  # CloudFrontOrigin:
  #   Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
  #   Conditional: DNSEnabled
  #   Properties:
  #     CloudFrontOriginAccessIdentityConfig:
  #       Comment: !Sub "The origin for ${DNSName}"
  #
  # CloudFrontDistribution:
  #   Type: AWS::CloudFront::Distribution
  #   Conditional: DNSEnabled
  #   Properties:
  #     DistributionConfig:
  #       Aliases:
  #         - !Ref DNSName
  #       DefaultCacheBehavior:
  #         AllowedMethods:
  #           - GET
  #           - HEAD
  #           - OPTIONS
  #         ForwardedValues:
  #           QueryString: false
  #           Cookies:
  #             Forward: none
  #         TargetOriginId: Root
  #         ViewerProtocolPolicy: https-only
  #       DefaultRootObject: index.html
  #       Enabled: true
  #       Origins:
  #         - Id: Root
  #           DomainName: !Sub "${Bucket}.s3.amazonaws.com"
  #           OriginPath: !Sub "/${Prefix}/static"
  #           S3OriginConfig:
  #             OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOrigin}"
  #       ViewerCertificate:
  #         AcmCertificateArn: !Ref Certificate
  #         SslSupportMethod: sni-only
  #
  # RecordSetGroup:
  #   Type: AWS::Route53::RecordSetGroup
  #   Condition: DNSEnabled
  #   Properties:
  #     HostedZoneId: !Ref HostedZoneID
  #     RecordSets:
  #       - Type: A
  #         Name: !Ref DNSName
  #         AliasTarget:
  #           DNSName: !GetAtt CloudFrontDistribution.DomainName
  #           HostedZoneId: Z2FDTNDATAQYW2
  #       {{- range .Domains }}
  #       - Type: A
  #         Name: !Sub "{{ .ID }}.${DNSName}"
  #         AliasTarget:
  #           DNSName: !GetAtt {{ .Name }}Domain.Outputs.DistributionDomainName
  #           HostedZoneId: Z2FDTNDATAQYW2
  #       {{- end }}