pipeline.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: Pipeline using CodePipeline and CodeBuild for continuous delivery of a single-page application to S3
Parameters:
  SARFunctionName:
    Type: String
    Description: Name of the Lambda Function used for deploying to SAR
  StagingBucketPrefix:
    Type: String
    Description: Prefix for bucket to stage artifact to
    Default: pipeline-dashboard
  GitHubRepoCB:
    Type: String
    Description: URL for source code
    Default: https://github.com/stelligent/pipeline-dashboard.git
  SiteBucketName:
    Type: String
    Description: Name of bucket to create to host the website
  GitHubUser:
    Type: String
    Description: GitHub User
    Default: "stelligent"
  GitHubRepoCPL:
    Type: String
    Description: GitHub Repo to pull from. Only the Name. not the URL
    Default: "pipeline-dashboard"
  GitHubBranch:
    Type: String
    Description: GitHub Branch
    Default: "master"
  GitHubToken:
    NoEcho: true
    Type: String
    Description: Secret. It might look something like 9b189a1654643522561f7b3ebd44a1531a4287af OAuthToken with access to Repo. Go to https://github.com/settings/tokens
  BuildType:
    Type: String
    Default: "LINUX_CONTAINER"
    Description: The build container type to use for building the app
  BuildComputeType:
    Type: String
    Default: "BUILD_GENERAL1_SMALL"
    Description: The build compute type to use for building the app
  BuildImage:
    Type: String
    Default: "aws/codebuild/ubuntu-base:14.04"
    Description: The build image to use for building the app
Conditions:
  HasGitHubToken:
    "Fn::Not":
      - "Fn::Equals":
          - ""
          - !Ref GitHubToken
Resources:
  BuildRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: pipeline-dashboard-codebuild
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: push-image
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - s3:CreateBucket
                  - s3:ListBucket
                  - s3:PutBucketPolicy
                  - lambda:*
                Resource: !Sub arn:aws:s3:::${StagingBucket}
                Effect: Allow
              - Action:
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:PutObject
                  - lambda:*
                Resource: !Sub arn:aws:s3:::${StagingBucket}/*
                Effect: Allow
              - Action:
                  - s3:CreateBucket
                  - s3:ListBucket
                  - s3:PutBucketPolicy
                  - lambda:*
                Resource: !Sub arn:aws:s3:::${PipelineBucket}
                Effect: Allow
              - Action:
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:PutObject
                  - lambda:*
                Resource: !Sub arn:aws:s3:::${PipelineBucket}/*
                Effect: Allow
              - Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Effect: Allow
                Resource: "*"
  BuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Environment:
        EnvironmentVariables:
          - Name: STAGING_BUCKET_PREFIX
            Value: !Ref StagingBucketPrefix
        Type: LINUX_CONTAINER
        Image: aws/codebuild/standard:3.0
        ComputeType: BUILD_GENERAL1_SMALL
      Name: pipeline-dashboard
      Description: Stage pipeline-dashboard
      ServiceRole: !GetAtt BuildRole.Arn
      Source:
        Type: CODEPIPELINE
      # should be true, but webhook from CFN was failing?!
      #Triggers:
      #  Webhook: true
      Artifacts:
        Type: CODEPIPELINE
  StagingBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${StagingBucketPrefix}-${AWS::Region}
  StagingBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref StagingBucket
      PolicyDocument:
        Version: "2012-10-17"
        Id: StagingBucketPolicy
        Statement:
          - Sid: PublicAccess
            Effect: Allow
            Principal: "*"
            Action: s3:GetObject
            Resource: !Sub arn:aws:s3:::${StagingBucket}/*
  CodePipelineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: codepipeline-service
          PolicyDocument:
            Statement:
              - Action:
                  - codebuild:*
                Resource: "*"
                Effect: Allow
              - Action:
                  - lambda:*
                Resource: "*"
                Effect: Allow
              - Action:
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
                Resource: "*"
                Effect: Allow
              - Action:
                  - s3:PutObject
                Resource:
                  - arn:aws:s3:::codepipeline*
                Effect: Allow
              - Action:
                  - s3:*
                  - cloudformation:*
                  - iam:PassRole
                Resource: "*"
                Effect: Allow
            Version: "2012-10-17"
  PipelineBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt CodePipelineRole.Arn
      Stages:
        - Name: Source
          Actions:
            - InputArtifacts: []
              Name: Source
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: "1"
                Provider: GitHub
              OutputArtifacts:
                - Name: SourceArtifacts
              Configuration:
                Owner: !Ref GitHubUser
                Repo: !Ref GitHubRepoCPL
                Branch: !Ref GitHubBranch
                OAuthToken: !Ref GitHubToken
              RunOrder: 1
        - Name: Build
          Actions:
            - Name: BuildLambdaFunction
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: "1"
                Provider: CodeBuild
              InputArtifacts:
                - Name: SourceArtifacts
              OutputArtifacts:
                - Name: BuildArtifact
              Configuration:
                ProjectName: !Ref BuildProject
              RunOrder: 1
        - Name: Publish
          Actions:
            - Name: PublishToSAR
              ActionTypeId:
                Category: Invoke
                Owner: AWS
                Version: "1"
                Provider: Lambda
              InputArtifacts:
                - Name: BuildArtifact
              Configuration:
                FunctionName: !Ref SARFunctionName
              RunOrder: 1
      ArtifactStore:
        Type: S3
        Location: !Ref PipelineBucket
Outputs:
  PipelineUrl:
    Value: !Sub https://console.aws.amazon.com/codepipeline/home?region=${AWS::Region}#/view/${Pipeline}
    Description: CodePipeline URL