code-pipeline.yaml

#  Copyright 2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with
#  the License. A copy of the License is located at
#      http://aws.amazon.com/apache2.0/
#  or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
#  CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and
#  limitations under the License.

AWSTemplateFormatVersion: '2010-09-09'
Description: CodePipeline for the Sample Lambda Function


Parameters:
  ProjectName:
    Description: Name of the Project
    Type: String
    Default: "serverless-pypi-user"

Resources:

  S3Bucket:
    Type: AWS::S3::Bucket

  CodeRepository:
    Type: AWS::CodeCommit::Repository
    Properties:
      RepositoryDescription: !Sub "Source code for ${ProjectName}"
      RepositoryName: !Ref ProjectName

  BuildProjectRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${ProjectName}-CodeBuildRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
  BuildProjectPolicy:
    Type: AWS::IAM::Policy
    DependsOn: S3BucketPolicy
    Properties:
      PolicyName: !Sub ${ProjectName}-CodeBuildPolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Action:
              - s3:PutObject
              - s3:GetBucketPolicy
              - s3:GetObject
              - s3:ListBucket
            Resource:
             - !Join ['',['arn:aws:s3:::',!Ref S3Bucket, '/*']]
             - !Join ['',['arn:aws:s3:::',!Ref S3Bucket]]
          -
            Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource: arn:aws:logs:*:*:*
      Roles:
        -
          !Ref BuildProjectRole
  BuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Ref ProjectName
      Description: !Ref ProjectName
      ServiceRole: !GetAtt BuildProjectRole.Arn
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:2.0
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: S3Bucket
            Value: !Ref S3Bucket
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                python: 3.7
              commands:
                - ls -R
            build:
              commands:
                - pip install --user aws-sam-cli
                - USER_BASE_PATH=$(python -m site --user-base)
                - export PATH=$PATH:$USER_BASE_PATH/bin
                - sam build --use-container -b ./build/ -t batch/template.yaml
                - aws cloudformation package --template-file ./build/template.yaml --s3-bucket $S3Bucket --s3-prefix ie/batch --output-template-file ./batch_template.yaml
                - sam build --use-container -b ./build/ -t content/template.yaml
                - aws cloudformation package --template-file ./build/template.yaml --s3-bucket $S3Bucket --s3-prefix ie/batch --output-template-file ./content_template.yaml
          artifacts:
            files:
              - ./batch_template.yaml
              - ./content_template.yaml
            discard-paths: yes

      TimeoutInMinutes: 10
      Tags:
        - Key: Name
          Value: !Ref ProjectName
  PipeLineRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${ProjectName}-codepipeline-role
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
  PipelinePolicy:
    Type: AWS::IAM::Policy
    DependsOn: S3BucketPolicy
    Properties:
      PolicyName: !Sub ${ProjectName}-codepipeline-policy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Action:
              - codepipeline:*
              - iam:ListRoles
              - cloudformation:Describe*
              - cloudFormation:List*
              - codecommit:BatchGetRepositories
              - codecommit:List*
              - codecommit:Get*
              - codecommit:GitPull
              - codecommit:UploadArchive
              - codecommit:CancelUploadArchive
              - codebuild:BatchGetBuilds
              - codebuild:StartBuild
              - cloudformation:*
              - iam:PassRole
              - lambda:*
              - s3:*
            Resource:
              - "*"
          -
            Effect: Allow
            Action:
              - s3:PutObject
              - s3:GetBucketPolicy
              - s3:GetObject
              - s3:ListBucket
            Resource:
             - !Join ['',['arn:aws:s3:::',!Ref S3Bucket, '/*']]
             - !Join ['',['arn:aws:s3:::',!Ref S3Bucket]]
          -
            Effect: Allow
            Action:
              - sts:AssumeRole
            Resource:
              - !GetAtt PipeLineRole.Arn

      Roles:
        - !Ref PipeLineRole
  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    DependsOn:
      - PipelinePolicy
      - S3BucketPolicy
    Properties:
      RoleArn: !GetAtt PipeLineRole.Arn
      Name: !Ref AWS::StackName
      ArtifactStore:
        Type: S3
        Location: !Ref S3Bucket
      Stages:
        - Name: Source
          Actions:
            - Name: App
              ActionTypeId:
                Category: Source
                Owner: AWS
                Version: 1
                Provider: CodeCommit
              Configuration:
                RepositoryName: !GetAtt CodeRepository.Name
                BranchName: develop
              OutputArtifacts:
                - Name: SCCheckoutArtifact
              RunOrder: 1
              RoleArn: !GetAtt PipeLineRole.Arn
        - Name: Build
          Actions:
          - Name: Build
            ActionTypeId:
              Category: Build
              Owner: AWS
              Version: 1
              Provider: CodeBuild
            Configuration:
              ProjectName: !Ref BuildProject
            RunOrder: 1
            InputArtifacts:
              - Name: SCCheckoutArtifact
            OutputArtifacts:
              - Name: BuildOutput


  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Statement:
          -
            Action:
              - s3:*
            Effect: Allow
            Resource:
              - !Sub arn:aws:s3:::${S3Bucket}
              - !Sub arn:aws:s3:::${S3Bucket}/*
            Principal:
              AWS:
                - !Sub arn:aws:iam::${TestAccount}:role/ToolsAcctCodePipelineCloudFormationRole${ProjectName}
                - !Sub arn:aws:iam::${TestAccount}:role/CloudFormationDeployerRole${ProjectName}
                - !Sub arn:aws:iam::${ProdAccount}:role/ToolsAcctCodePipelineCloudFormationRole${ProjectName}
                - !Sub arn:aws:iam::${ProdAccount}:role/CloudFormationDeployerRole${ProjectName}
                - !GetAtt [BuildProjectRole,Arn]
                - !GetAtt PipeLineRole.Arn
#                - !GetAtt SSEKMSStripperFunction.Arn