cfn-deployment.yml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Parameters:
  GHSECRET:
    Type: String
  SSMKeyArn:
    Type: String
  DeploymentBucket:
    Type: String
  md5:
    Type: String
  SSMLeadingKey:
    Type: String
    Default: 'dockerhub-password'
  WebhookEndpoint:
    Type: String
  WebhookEndpointZoneName:
    Type: String
  CloudFrontDistro:
    Type: String

Resources:
  ListenerFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: listener.lambda_handler
      Runtime: python2.7
      CodeUri:
        Bucket: !Ref DeploymentBucket
        Key: !Ref md5
      Description: Accepts GitHub event and invokes CodeBuild spawner
      MemorySize: 128
      Timeout: 5
      Policies:
        - Statement:
            Effect: Allow
            Action: "lambda:InvokeFunction"
            Resource:
              - !GetAtt SpawnCodeBuildFunction.Arn
      Environment:
        Variables:
          GHSECRET: !Ref GHSECRET
          SpawnCodeBuildFunctionArn: !GetAtt SpawnCodeBuildFunction.Arn
      Events:
        PostApi:
          Type: Api
          Properties:
            Path: /
            Method: POST

  ListenerDNSEntry:
    Type: AWS::Route53::RecordSet
    Properties:
      AliasTarget:
        DNSName: !Ref CloudFrontDistro
        HostedZoneId: Z2FDTNDATAQYW2 # CloudFront zone id hardcoded by design
      HostedZoneName: !Ref WebhookEndpointZoneName
      Name: !Ref WebhookEndpoint
      Type: A
  ListenerDNSEntry6: # GitHub actually doesn't support IPv6
    Type: AWS::Route53::RecordSet
    Properties:
      AliasTarget:
        DNSName: !Ref CloudFrontDistro
        HostedZoneId: Z2FDTNDATAQYW2 # CloudFront zone id hardcoded by design
      HostedZoneName: !Ref WebhookEndpointZoneName
      Name: !Ref WebhookEndpoint
      Type: AAAA

  ListenerPathMapping:
    Type: "AWS::ApiGateway::BasePathMapping"
    Properties:
      DomainName: !Ref WebhookEndpoint
      RestApiId: !Ref ServerlessRestApi
      Stage: !Ref ServerlessRestApiProdStage

  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/CloudWatchLogsFullAccess
      - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Sid: 'CodeBuild'
          Principal:
            Service:
            - codebuild.amazonaws.com
          Action:
            - sts:AssumeRole
      Path: "/cfn/"
      Policies:
      - PolicyName: S3DeleteBucket
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - s3:DeleteObject
            - s3:DeleteBucket
            Resource:
              - !Sub "arn:aws:s3:::aws-codebuild-dockerhub-${AWS::AccountId}-*"
      - PolicyName: CredstashAccess
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - kms:Decrypt
            Resource:
              - !Ref SSMKeyArn
          - Effect: Allow
            Action:
            - ssm:GetParameters
            Resource:
              - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${SSMLeadingKey}"
      - PolicyName: InvokeLambdaNotifyFunction
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - lambda:InvokeFunction
            Resource:
              - !GetAtt NotifyFunction.Arn

  SpawnCodeBuildFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: spawn-codebuild.lambda_handler
      Runtime: python2.7
      CodeUri:
        Bucket: !Ref DeploymentBucket
        Key: !Ref md5
      Description: Provisions CodeBuild Job
      MemorySize: 128
      Timeout: 8
      Policies:
        - Statement:
            Effect: Allow
            Action:
            - s3:CreateBucket
            - s3:PutObject
            Resource:
              - !Sub "arn:aws:s3:::aws-codebuild-dockerhub-${AWS::AccountId}-*"
        - Statement:
            Effect: Allow
            Action:
            - codebuild:CreateProject
            - codebuild:StartBuild
            Resource: '*'
        - Statement:
            Effect: Allow
            Action:
            - iam:PassRole
            Resource:
              - !GetAtt CodeBuildRole.Arn
      Environment:
        Variables:
          CodeBuildRoleArn: !GetAtt CodeBuildRole.Arn
          SSMLeadingKey: !Ref SSMLeadingKey
          NotifyFunctionName: !Ref NotifyFunction

  CleanCodeBuildFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: clean-old-codebuilds.lambda_handler
      Runtime: python2.7
      CodeUri:
        Bucket: !Ref DeploymentBucket
        Key: !Ref md5
      Description: Removes old CodeBuild Jobs
      MemorySize: 128
      Timeout: 300
      Events:
        OnceWeek:
          Type: Schedule
          Properties:
            Schedule: rate(7 days)
      Policies:
        - Statement:
            Effect: Allow
            Action:
            - s3:DeleteObject
            - s3:DeleteBucket
            - s3:ListBucket
            Resource:
              - !Sub "arn:aws:s3:::aws-codebuild-dockerhub-${AWS::AccountId}-*"
        - Statement:
            Effect: Allow
            Action:
            - codebuild:ListProjects
            - codebuild:BatchGetProjects
            Resource: '*'
        - Statement:
            Effect: Allow
            Action:
            - codebuild:DeleteProject
            Resource:
              - !Sub "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/aws-codebuild-dockerhub-*"
        - Statement:
            Effect: Allow
            Action:
            - logs:DeleteLogGroup
            Resource:
              - arn:aws:logs:*:*:log-group:/aws/codebuild/*:log-stream:*

  NotifyFunctionSNS:
    Type: AWS::SNS::Topic

  NotifyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: notify-status-sns.lambda_handler
      Runtime: python2.7
      CodeUri:
        Bucket: !Ref DeploymentBucket
        Key: !Ref md5
      Description: Notifies on Codebuild Status (SNS Proxy)
      MemorySize: 128
      Timeout: 30
      Environment:
        Variables:
          NotifyFunctionSNSArn: !Ref NotifyFunctionSNS
      Policies:
        - Statement:
            Effect: Allow
            Action:
            - sns:Publish
            Resource:
              - !Ref NotifyFunctionSNS
        - Statement:
            Effect: Allow
            Action:
            - codebuild:BatchGetBuilds
            Resource: '*'