aws_seed.yml

AWSTemplateFormatVersion: 2010-09-09

Parameters:
  PipelineName:
    Type: String
    MaxLength: 54
    MinLength: 4
    AllowedPattern: ^[A-Za-z0-9][A-Za-z0-9\-]{2,52}[A-Za-z0-9]$
    ConstraintDescription: "Must only contain alphanumeric or dashes (and cannot start or end with a dash)"
  BucketPrefix:
    Type: String
    MaxLength: 39
    MinLength: 3
    AllowedPattern: ^[0-9a-z][0-9a-z\-]{1,37}[0-9a-z]$
  BucketRegion:
    Type: String
    AllowedValues:
      - 'ap-northeast-1'
      - 'ap-northeast-2'
      - 'ap-south-1'
      - 'ap-southeast-1'
      - 'ap-southeast-2'
      - 'ca-central-1'
      - 'eu-central-1'
      - 'eu-north-1'
      - 'eu-west-1'
      - 'eu-west-2'
      - 'eu-west-3'
      - 'sa-east-1'
      - 'us-east-1'
      - 'us-east-2'
      - 'us-west-1'
      - 'us-west-2'
  BucketSuffix:
    Type: String
    MaxLength: 9
    MinLength: 1
    Default: 'inception'

Resources:

  CodeCommitRepository:
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    DependsOn:
      - CloudFormationDeployActionRole
    Type: 'AWS::CodeCommit::Repository'
    Properties:
      RepositoryName: !Ref PipelineName
      RepositoryDescription: !Sub '${PipelineName} CodeCommit Repository'

  CodePipelineBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      BucketName: !Sub '${BucketPrefix}-${BucketRegion}-${BucketSuffix}'
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  CloudFormationDeployActionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: ['sts:AssumeRole']
          Effect: Allow
          Principal:
            Service: [cloudformation.amazonaws.com]
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: CloudFormationRole
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - 'cloudformation:CreateStack'
                  - 'cloudformation:DeleteStack'
                  - 'cloudformation:DescribeStacks'
                  - 'codebuild:CreateProject'
                  - 'codebuild:DeleteProject'
                  - 'codecommit:CreateRepository'
                  - 'codecommit:DeleteRepository'
                  - 'codecommit:GetRepository'
                  - 'codecommit:GitPush'
                  - 'codecommit:ListRepositories'
                  - 'codepipeline:CreatePipeline'
                  - 'codepipeline:DeletePipeline'
                  - 'codepipeline:GetPipeline'
                  - 'codepipeline:GetPipelineState'
                  - 'codepipeline:StartPipelineExecution'
                  - 'codepipeline:UpdatePipeline'
                  - 'iam:CreateRole'
                  - 'iam:DeleteRole'
                  - 'iam:DeleteRolePolicy'
                  - 'iam:GetRole'
                  - 'iam:GetRolePolicy'
                  - 'iam:PassRole'
                  - 'iam:PutRolePolicy'
                  - 's3:CreateBucket'
                  - 's3:DeleteBucket'
                  - 's3:DeleteBucketPolicy'
                  - 's3:DeleteObject'
                  - 's3:GetBucketLocation'
                  - 's3:GetBucketPolicy'
                  - 's3:ListAllMyBuckets'
                  - 's3:ListBucket'
                  - 's3:PutAccelerateConfiguration'
                  - 's3:PutAccountPublicAccessBlock'
                  - 's3:PutBucketAcl'
                  - 's3:PutBucketPolicy'
                  - 's3:PutBucketPublicAccessBlock'
                  - 's3:PutBucketVersioning'
                  - 's3:PutEncryptionConfiguration'
                  - 's3:PutLifecycleConfiguration'
                Effect: Allow
                Resource: ['*']
      RoleName: !Sub '${PipelineName}-CfnDeploy'

  CodePipelineRole:
    DependsOn:
      - CloudFormationDeployActionRole
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
        - PolicyName: codepipeline-service
          PolicyDocument:
            Statement:
              - Action:
                  - 'cloudformation:CreateStack'
                  - 'cloudformation:DeleteStack'
                  - 'cloudformation:DescribeStackEvents'
                  - 'cloudformation:DescribeStackResource'
                  - 'cloudformation:DescribeStackResources'
                  - 'cloudformation:DescribeStacks'
                  - 'cloudformation:GetTemplate'
                  - 'cloudformation:UpdateStack'
                  - 'codebuild:BatchGetBuilds'
                  - 'codebuild:StartBuild'
                  - 'codecommit:CancelUploadArchive'
                  - 'codecommit:GetBranch'
                  - 'codecommit:GetCommit'
                  - 'codecommit:GetUploadArchiveStatus'
                  - 'codecommit:UploadArchive'
                  - 'iam:PassRole'
                  - 's3:CreateBucket'
                  - 's3:DeleteBucket'
                  - 's3:DeleteBucketEncryption'
                  - 's3:DeleteBucketPolicy'
                  - 's3:DeleteObject'
                  - 's3:DescribeBucketPolicy'
                  - 's3:GetBucketEncryption'
                  - 's3:GetBucketPolicy'
                  - 's3:GetBucketPolicyStatus'
                  - 's3:GetBucketVersioning'
                  - 's3:GetEncryptionConfiguration'
                  - 's3:GetObject'
                  - 's3:GetObjectVersion'
                  - 's3:ListBucket'
                  - 's3:PutBucketPolicy'
                  - 's3:PutEncryptionConfiguration'
                  - 's3:PutObject'
                  - 's3:SetBucketEncryption'
                Resource: ['*']
                Effect: Allow
            Version: 2012-10-17
      RoleName: !Sub '${PipelineName}-Pipeline'

  CodePipeline:
    Type: 'AWS::CodePipeline::Pipeline'
    Properties:
      ArtifactStore:
        Type: S3
        Location: !Ref CodePipelineBucket
      Name: !Ref PipelineName
      RestartExecutionOnUpdate: true
      RoleArn: !GetAtt CodePipelineRole.Arn
      Stages:
        - Name: Source
          Actions:
            - InputArtifacts: []
              Name: Source
              ActionTypeId:
                Category: Source
                Owner: AWS
                Version: '1'
                Provider: CodeCommit
              OutputArtifacts:
                - Name:  'CodeCommitSource'
              Configuration:
                BranchName: 'master'
                RepositoryName: !GetAtt CodeCommitRepository.Name
              RunOrder: 1
        - Name: AdministerPipeline
          Actions:
            - Name: 'AdministerPipeline'
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: '1'
              Configuration:
                ActionMode: REPLACE_ON_FAILURE 
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt CloudFormationDeployActionRole.Arn
                StackName: !Sub '${PipelineName}-Inception'
                TemplateConfiguration: 'CodeCommitSource::aws_seed.json'
                TemplatePath: 'CodeCommitSource::aws_seed.yml'
              InputArtifacts:
                - Name: 'CodeCommitSource'
              RunOrder: 1
        - Name: Deploy
          Actions:
            - Name: DeployApplication
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: '1'
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref CodeBuildProject
              InputArtifacts:
                - Name: 'CodeCommitSource'
              OutputArtifacts:
                - Name: 'Ignored'
              RunOrder: 2

  CodeBuildRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: [codebuild.amazonaws.com]
            Action: ['sts:AssumeRole']
      Path: /
      Policies:
        - PolicyName: codebuild-service
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - 'dynamodb:CreateTable'
                  - 'dynamodb:DeleteTable'
                  - 'dynamodb:DescribeTable'
                  - 'dynamodb:ListTables'
                  - 'dynamodb:ListTagsOfResource'
                  - 'dynamodb:TagResource'
                  - 'dynamodb:UntagResource'
                  - 'dynamodb:UpdateTable'
                  - 'dynamodb:UpdateTimeToLive'
                  - 'apigateway:DELETE'
                  - 'apigateway:GET'
                  - 'apigateway:PATCH'
                  - 'apigateway:POST'
                  - 'apigateway:PUT'
                  - 'cloudformation:CreateStack'
                  - 'cloudformation:DeleteStack'
                  - 'cloudformation:DescribeStackEvents'
                  - 'cloudformation:DescribeStackResource'
                  - 'cloudformation:DescribeStackResources'
                  - 'cloudformation:DescribeStacks'
                  - 'cloudformation:ListStackResources'
                  - 'cloudformation:UpdateStack'
                  - 'cloudformation:ValidateTemplate'
                  - 'iam:CreateRole'
                  - 'iam:DeleteRole'
                  - 'iam:DeleteRolePolicy'
                  - 'iam:GetRole'
                  - 'iam:GetRolePolicy'
                  - 'iam:PassRole'
                  - 'iam:PutRolePolicy'
                  - 'iam:CreateServiceLinkedRole'
                  - 'lambda:AddPermission'
                  - 'lambda:CreateFunction'
                  - 'lambda:DeleteFunction'
                  - 'lambda:GetFunction'
                  - 'lambda:GetFunctionConfiguration'
                  - 'lambda:ListVersionsByFunction'
                  - 'lambda:PublishVersion'
                  - 'lambda:RemovePermission'
                  - 'lambda:UpdateFunctionCode'
                  - 'lambda:UpdateFunctionConfiguration'
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:DeleteLogGroup'
                  - 'logs:DeleteLogStream'
                  - 'logs:DescribeLogGroups'
                  - 'logs:PutLogEvents'
                  - 's3:CreateBucket'
                  - 's3:DeleteBucket'
                  - 's3:DeleteBucketPolicy'
                  - 's3:DeleteObject'
                  - 's3:Get*'
                  - 's3:GetEncryptionConfiguration'
                  - 's3:ListBucket'
                  - 's3:PutBucketPolicy'
                  - 's3:PutBucketWebsite'
                  - 's3:PutEncryptionConfiguration'
                  - 's3:PutObject'
                  - 's3:PutObjectAcl'
                  - 's3:PutObjectVersionAcl'
                  - 's3:SetBucketEncryption'
                  - 's3:PutBucketWebsite'
                Resource: '*'
            Version: 2012-10-17
      RoleName: !Sub '${PipelineName}-CodeBuild'

  CodeBuildProject:
    Type: 'AWS::CodeBuild::Project'
    Properties:
      Artifacts:
        Packaging: ZIP
        Type: CODEPIPELINE
      Description: Deploy Application
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:2.0
        PrivilegedMode: true
      Name: !Ref PipelineName
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Source:
        BuildSpec: 'app/buildspec.yml'
        Type: CODEPIPELINE
      TimeoutInMinutes: 10

Outputs:
  CodeCommitRepositoryArn:
    Description: CodeCommit Arn
    Value: !GetAtt CodeCommitRepository.Arn
  CodeCommitRepositoryCloneUrlHttp:
    Description: CodeCommit CloneUrlHttp
    Value: !GetAtt CodeCommitRepository.CloneUrlHttp
  CloudFormationDeployActionRoleArn:
    Description: CloudFormationDeployActionRole Arn
    Value: !GetAtt CloudFormationDeployActionRole.Arn
  CodePipelineRoleArn:
    Description: CodePipelineRole Arn
    Value: !GetAtt CodePipelineRole.Arn
  CodePipelineName:
    Description: CodePipeline Name
    Value: !Ref CodePipeline