pipeline.yml

AWSTemplateFormatVersion: "2010-09-09"

Description: "[CloudFormation] [Utility] CI/CD Pipeline"

Parameters:

  GitHubToken:
    Type: String
    Description: |
      The GitHubToken used to communicate with GitHub
    NoEcho: true

  Repository:
    Type: String
    AllowedPattern: "^[-_a-zA-Z0-9]+/[-_a-zA-Z0-9]+$"
    ConstraintDescription: |
      Ensure you have defined a full path, including the username or
      organisation name.
    Description: |
      The full name of the repository, such as "<username>/<name>".

  Branch:
    Type: String
    AllowedPattern: "^[-_a-zA-Z0-9]+$"
    ConstraintDescription: |
      Only alpha numeric characters, as well as "-" and "_" are allowed.
    Description: |
      Branch to use from the repository.

  SlackBotToken:
    Type: String
    NoEcho: true
    Description: |
      The auth token for the slack bot, enabling it access to post
      messages to channels.

Resources:

  PipelineArtifactStore:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Status: Enabled
            ExpirationInDays: 1

  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RestartExecutionOnUpdate: true
      ArtifactStore:
        Location: !Ref PipelineArtifactStore
        Type: S3
      RoleArn: !GetAtt PipelineRole.Arn
      Stages:
        - Name: Source
          Actions:
            - Name: GitHub
              RunOrder: 1
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: 1
                Provider: GitHub
              OutputArtifacts:
                - Name: GitHubOutput
              Configuration:
                Owner: !Select [ 0, !Split [ "/", !Ref Repository ] ]
                Repo: !Select [ 1, !Split [ "/", !Ref Repository ] ]
                Branch: !Ref Branch
                OAuthToken: !Ref GitHubToken
        - Name: Pipeline
          Actions:
            - Name: Update
              RunOrder: 1
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              InputArtifacts:
                - Name: GitHubOutput
              Configuration:
                ActionMode: CREATE_UPDATE
                Capabilities: CAPABILITY_IAM
                RoleArn: !GetAtt CloudformationRole.Arn
                StackName: !Ref AWS::StackName
                TemplatePath: GitHubOutput::pipeline.yml
                ParameterOverrides: !Sub |
                  {
                    "GitHubToken": "${GitHubToken}",
                    "SlackBotToken": "${SlackBotToken}",
                    "Repository": "${Repository}",
                    "Branch": "${Branch}"
                  }
        - Name: Build
          Actions:
            - Name: Build
              RunOrder: 1
              InputArtifacts:
                - Name: GitHubOutput
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              OutputArtifacts:
                - Name: BuildOutput
              Configuration:
                ProjectName: !Ref Build
        - Name: Release
          Actions:
            - Name: Create
              RunOrder: 1
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              InputArtifacts:
                - Name: BuildOutput
                - Name: GitHubOutput
              Configuration:
                ActionMode: CHANGE_SET_REPLACE
                Capabilities: CAPABILITY_IAM
                RoleArn: !GetAtt CloudformationRole.Arn
                StackName: !Sub "${AWS::StackName}-service"
                ChangeSetName: !Sub "${AWS::StackName}-service"
                TemplateConfiguration: GitHubOutput::config.json
                TemplatePath: BuildOutput::template.yml
                ParameterOverrides: !Sub |
                  {
                    "Token": "${SlackBotToken}"
                  }
            - Name: Deploy
              RunOrder: 3
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                Capabilities: CAPABILITY_IAM
                ChangeSetName: !Sub "${AWS::StackName}-service"
                RoleArn: !GetAtt CloudformationRole.Arn
                StackName: !Sub "${AWS::StackName}-service"
        - Name: Templates
          Actions:
            - Name: CodeBuild
              RunOrder: 1
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              InputArtifacts:
                - Name: GitHubOutput
              Configuration:
                ActionMode: CREATE_UPDATE
                Capabilities: CAPABILITY_IAM
                RoleArn: !GetAtt CloudformationRole.Arn
                StackName: !Ref AWS::StackName
                StackName: !Sub "${AWS::StackName}-template-codebuild"
                TemplatePath: GitHubOutput::templates/codebuild.yml
                ParameterOverrides: !Sub |
                  {
                    "Key": "/Public/${Repository}/Templates/CodeBuild"
                  }
            - Name: CodePipeline
              RunOrder: 1
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              InputArtifacts:
                - Name: GitHubOutput
              Configuration:
                ActionMode: CREATE_UPDATE
                Capabilities: CAPABILITY_IAM
                RoleArn: !GetAtt CloudformationRole.Arn
                StackName: !Ref AWS::StackName
                StackName: !Sub "${AWS::StackName}-template-codepipeline"
                TemplatePath: GitHubOutput::templates/codepipeline.yml
                ParameterOverrides: !Sub |
                  {
                    "Key": "/Public/${Repository}/Templates/CodePipeline"
                  }

  Build:
    Type: AWS::CodeBuild::Project
    Properties:
      TimeoutInMinutes: 5
      ServiceRole: !GetAtt BuildRole.Arn
      Cache:
        Location: !Sub "${PipelineArtifactStore}/Cache/Build"
        Type: S3
      Source:
        Type: CODEPIPELINE
        BuildSpec: buildspec.yml
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/nodejs:8.11.0
        EnvironmentVariables:
          - Name: ARTIFACT_STORE
            Type: PLAINTEXT
            Value: !Ref PipelineArtifactStore
          - Name: AWS_ACCOUNT_ID
            Type: PLAINTEXT
            Value: !Ref AWS::AccountId
      Artifacts:
        Type: CODEPIPELINE

  BuildLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/codebuild/${Build}"
      RetentionInDays: 1

  CloudformationRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: !Sub "cloudformation.${AWS::URLSuffix}"
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: RestrictedCloudFormationAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - 'cloudformation:CreateChangeSet'
                Effect: Allow
                Resource:
                  - !Sub "arn:${AWS::Partition}:cloudformation:${AWS::Region}:aws:transform/Serverless-2016-10-31"
              - Action:
                  - 'cloudformation:ExecuteChangeSet'
                Effect: Allow
                Resource:
                  - '*'
                Condition:
                  StringLike:
                    cloudformation:ChangeSetName: !Sub "${AWS::StackName}-*"
              - Action:
                  - '*'
                Effect: Allow
                Resource:
                  - '*'
                Condition:
                  ForAllValues:StringLike:
                    cloudformation:TemplateURL: !Sub "https://s3.${AWS::URLSuffix}/${PipelineArtifactStore}/*"

  PipelineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: !Sub "codepipeline.${AWS::URLSuffix}"
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: CodePipelineAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - 's3:*'
                Effect: Allow
                Resource:
                  - !Sub "arn:${AWS::Partition}:s3:::${PipelineArtifactStore}"
                  - !Sub "arn:${AWS::Partition}:s3:::${PipelineArtifactStore}/*"
              - Action:
                  - 'codebuild:*'
                Effect: Allow
                Resource:
                  - !Sub "arn:${AWS::Partition}:codebuild:${AWS::Region}:${AWS::AccountId}:project/${Build}"
              - Action:
                  - 'cloudformation:CreateStack'
                  - 'cloudformation:DescribeStacks'
                  - 'cloudformation:DeleteStack'
                  - 'cloudformation:UpdateStack'
                  - 'cloudformation:CreateChangeSet'
                  - 'cloudformation:ExecuteChangeSet'
                  - 'cloudformation:DeleteChangeSet'
                  - 'cloudformation:DescribeChangeSet'
                  - 'cloudformation:SetStackPolicy'
                Effect: Allow
                Resource:
                  - !Sub "arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}*/*"
              - Action:
                  - 'iam:PassRole'
                Effect: Allow
                Resource:
                  - !GetAtt CloudformationRole.Arn

  BuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: !Sub "codebuild.${AWS::URLSuffix}"
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: CodeBuildPackageAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Effect: Allow
                Resource: '*'
              - Action:
                  - 's3:*'
                Effect: Allow
                Resource:
                  - !GetAtt PipelineArtifactStore.Arn
                  - !Sub "${PipelineArtifactStore.Arn}/*"

Outputs:

  BuildConsoleURL:
    Description: Build URL
    Value: !Sub "https://console.aws.amazon.com/codebuild/home?region=${AWS::Region}#/projects/${Build}/view"

  PipelineConsoleURL:
    Description: Pipeline URL
    Value: !Sub "https://console.aws.amazon.com/codepipeline/home?region=${AWS::Region}#/view/${Pipeline}"