CrossAccountHelperMacros.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Cross account helper macros
Resources:
  # Role for the pipeline helper macro function.
  PipelineHelperMacroFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CrossAccount-PipelineHelperMacroFunction
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Ref PipelineHelperMacroFunctionPolicy

  PipelineHelperMacroFunctionPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: CrossAccount-PipelineHelperMacroFunction
      Description: Policy for cross account pipeline helper macro function
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - ssm:GetParameter
            Resource:
              - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/cross-account-pipeline-helper/*
          - Effect: Allow
            Action:
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource:
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/CrossAccount-PipelineHelperMacroFunction
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/CrossAccount-PipelineHelperMacroFunction:*
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/CrossAccount-PipelineHelper2MacroFunction
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/CrossAccount-PipelineHelper2MacroFunction:*

  PipelineHelperMacroFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/lambda/CrossAccount-PipelineHelperMacroFunction
      RetentionInDays: 3

  PipelineHelperMacroFunction:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: |
          const AWS = require('aws-sdk')

          exports.handler = async function main(event, context) {
            console.info(JSON.stringify(event));

            const accounts = event.params.Accounts || event.templateParameterValues.Accounts;
            const regions = event.params.Regions || event.templateParameterValues.Regions;
            const names = event.params.Names || event.templateParameterValues.Names;
            const manualApprovalNames = event.params.ManualApprovalNames;
            const approvalNotificationArn = event.params.ApprovalNotificationArn;
            const artifactBuckets = event.params.ArtifactBuckets || event.templateParameterValues.ArtifactBuckets;
            const artifactKMSKeys = event.params.ArtifactKMSKeys || event.templateParameterValues.ArtifactKMSKeys;
            const artifactRegions = event.params.ArtifactRegions || event.templateParameterValues.ArtifactRegions;

            const fragment = event.fragment;
            const stages = fragment.Properties.Stages;

            if (artifactRegions) {
              const artifactStores = [];
              for (var i = 0; i < artifactRegions.length; i++) {
                artifactStores.push({
                  ArtifactStore: {
                    Location: artifactBuckets[i],
                    Type: 'S3',
                    EncryptionKey: {
                      Id: artifactKMSKeys[i],
                      Type: 'KMS'
                    }
                  },
                  Region: artifactRegions[i]
                });
              }

              fragment.Properties.ArtifactStores = artifactStores;
            }

            for (const duplicate of event.params.DuplicateStages || []) {
              const stageIndex = stages.findIndex(s => s.Name === duplicate);
              const stageString = JSON.stringify(stages[stageIndex]);

              stages.splice(stageIndex, 1)

              for (var i = 0; i < accounts.length; i++) {
                const stage = JSON.parse(stageString.replace(/{ACCOUNT_ID}/g, accounts[i]).replace(/{REGION}/g, regions[i]).replace(/{NAME}/g, names[i]));
                stage.Name = `${stage.Name}-${names[i]}`;

                // if the manual intervention names list contains the name of the current item then we will inject an approval step
                if (manualApprovalNames && manualApprovalNames.findIndex(n => n === names[i]) !== -1) {
                  const approvalAction = {
                    Name: `${names[i]}-Approval`,
                    ActionTypeId: {
                      Category: 'Approval',
                      Owner: 'AWS',
                      Provider: 'Manual',
                      Version: '1'
                    },
                    Configuration: {
                      CustomData: `${fragment.Properties.Name} ${names[i]} Deployment`,
                      NotificationArn: approvalNotificationArn
                    },
                    RunOrder: 1
                  };
                  stage.Actions.splice(0, 0, approvalAction);

                }

                stages.splice(stageIndex + i, 0, stage);
              }
            }

            fragment.Properties.Stages = stages;

            console.info(JSON.stringify(fragment));

            return {
                requestId: event.requestId,
                status: 'success',
                fragment: fragment
            }
          }

      Description: Replicates a stage of a pipeline for each environment in the list
      FunctionName: CrossAccount-PipelineHelperMacroFunction
      Handler: index.handler
      MemorySize: 128
      Role: !GetAtt PipelineHelperMacroFunctionRole.Arn
      Runtime: nodejs16.x
      Timeout: 30

  PipelineHelper2MacroFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/lambda/CrossAccount-PipelineHelper2MacroFunction
      RetentionInDays: 3

  PipelineHelper2MacroFunction:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: |
          const AWS = require('aws-sdk')

          exports.handler = async function main(event, context) {
            console.info(JSON.stringify(event));

            const configParameterName = event.params.ConfigParameterName || event.templateParameterValues.ConfigParameterName;
            const approvalNotificationArn = event.params.ApprovalNotificationArn;
            const artifactBuckets = event.params.ArtifactBuckets || event.templateParameterValues.ArtifactBuckets;
            const artifactKMSKeys = event.params.ArtifactKMSKeys || event.templateParameterValues.ArtifactKMSKeys;
            const artifactRegions = event.params.ArtifactRegions || event.templateParameterValues.ArtifactRegions;

            const fragment = event.fragment;
            const stages = fragment.Properties.Stages;

            if (artifactRegions) {
              const artifactStores = [];
              for (var i = 0; i < artifactRegions.length; i++) {
                artifactStores.push({
                  ArtifactStore: {
                    Location: artifactBuckets[i],
                    Type: 'S3',
                    EncryptionKey: {
                      Id: artifactKMSKeys[i],
                      Type: 'KMS'
                    }
                  },
                  Region: artifactRegions[i]
                });
              }

              fragment.Properties.ArtifactStores = artifactStores;
            }

            const ssm = new AWS.SSM();
            const param = await ssm.getParameter({ Name: configParameterName }).promise();
            const stageDuplications = JSON.parse(param.Parameter.Value);
            for (const stageDuplication of stageDuplications || []) {
              const stageIndex = stages.findIndex(s => s.Name === stageDuplication.stage);

              let count = 1;
              for (const wave of stageDuplication.waves) {
                const stage = {
                  Name: `${stageDuplication.stage}-${wave.name}`,
                  Actions: []
                }

                const actionsString = JSON.stringify(stages[stageIndex].Actions);

                for (const environment of wave.environments) {
                  const actions = JSON.parse(actionsString.replace(/{ACCOUNT_ID}/g, environment.account).replace(/{REGION}/g, environment.region).replace(/{NAME}/g, environment.name));
                  for (const action of actions) {
                    action.Name = `${action.Name}-${environment.name}`
                  }

                  stage.Actions.push(...actions);
                }

                if (wave.manualApproval) {
                  const approvalAction = {
                    Name: `${wave.name}-Approval`,
                    ActionTypeId: {
                      Category: 'Approval',
                      Owner: 'AWS',
                      Provider: 'Manual',
                      Version: '1'
                    },
                    Configuration: {
                      CustomData: `${fragment.Properties.Name} ${wave.name} Deployment`,
                      NotificationArn: approvalNotificationArn
                    },
                    RunOrder: 1
                  };

                  stage.Actions.splice(0, 0, approvalAction);
                }

                stages.splice(stageIndex + count, 0, stage);
                count++;
              }

              // remove the stage template
              stages.splice(stageIndex, 1)
            }

            fragment.Properties.Stages = stages;

            console.info(JSON.stringify(fragment));

            return {
                requestId: event.requestId,
                status: 'success',
                fragment: fragment
            }
          }

      Description: Replicates a stage of a pipeline for based on the stage duplication config
      FunctionName: CrossAccount-PipelineHelper2MacroFunction
      Handler: index.handler
      MemorySize: 128
      Role: !GetAtt PipelineHelperMacroFunctionRole.Arn
      Runtime: nodejs16.x
      Timeout: 30

  PipelineHelperMacroLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /jasonwadsworth/CrossAccount-PipelineHelperMacro
      RetentionInDays: 3

  PipelineHelper2MacroLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /jasonwadsworth/CrossAccount-PipelineHelper2Macro
      RetentionInDays: 3

  PipelineHelperMacroRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CrossAccount-PipelineHelperMacro
      Path: /cross-account-service-role/
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Ref PipelineHelperMacroPolicy

  PipelineHelperMacroPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: CrossAccount-PipelineHelperMacro
      Path: /cross-account-service-role/
      Description: Policy for cross account pipeline helper macro
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource:
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/jasonwadsworth/CrossAccount-PipelineHelperMacro
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/jasonwadsworth/CrossAccount-PipelineHelperMacro:*
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/jasonwadsworth/CrossAccount-PipelineHelper2Macro
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/jasonwadsworth/CrossAccount-PipelineHelper2Macro:*

  PipelineHelperMacro:
    Type: AWS::CloudFormation::Macro
    Properties:
      Name: CrossAccount-PipelineHelperMacro
      Description: Replicates a stage of a pipeline for each environment in the list
      FunctionName: !GetAtt PipelineHelperMacroFunction.Arn
      LogGroupName: /jasonwadsworth/CrossAccount-PipelineHelperMacro
      LogRoleARN: !GetAtt PipelineHelperMacroRole.Arn

  PipelineHelper2Macro:
    Type: AWS::CloudFormation::Macro
    Properties:
      Name: CrossAccount-PipelineHelper2Macro
      Description: Replicates a stage of a pipeline based on the stage duplication config
      FunctionName: !GetAtt PipelineHelper2MacroFunction.Arn
      LogGroupName: /jasonwadsworth/CrossAccount-PipelineHelper2Macro
      LogRoleARN: !GetAtt PipelineHelperMacroRole.Arn

  CrossAccountPipelineHelperMacroInvokePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Policy to allow the Cross Account Pipeline Helper Macro to be invoked
      ManagedPolicyName: CrossAccount-PipelineHelperMacroInvoke
      Path: /cross-account-service-role/
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
              - lambda:InvokeFunction
            Effect: Allow
            Resource:
              - !GetAtt PipelineHelperMacroFunction.Arn
              - !GetAtt PipelineHelper2MacroFunction.Arn
      Roles:
        - CrossAccount-UpdatePipeline