template.yaml

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31
Description: |
  A Kubernetes ValidatingWebhookConfiguration and serverless backend:
  Deny Pods with container images that don't meet your compliance requirements.

Metadata:
  AWS::ServerlessRepo::Application:
    Name: amazon-ecr-repository-compliance-webhook
    Description: "A Kubernetes ValidatingWebhookConfiguration and serverless backend: Deny Pods with container images that don't meet your compliance requirements"

Parameters:
  ExecutionRole:
    Type: AWS::SSM::Parameter::Value<String>
    Description: IAM Role ARN
    Default: /ECRCompliance/starfleet/SAM/ExecutionRoleArn
  ApiGatewayVpcEndpointId:
    Type: AWS::SSM::Parameter::Value<String>
    Description: API Gateway VPC Endpoint ID
    Default: /ECRCompliance/starfleet/SAM/ApiGwVpcEndpointId

Resources:
  ECRRepositoryComplianceWebhookRestApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      Auth:
        ResourcePolicy:
          IntrinsicVpceWhitelist:
          - !Ref ApiGatewayVpcEndpointId
      EndpointConfiguration:
        Type: PRIVATE
        VPCEndpointIds:
        - !Ref ApiGatewayVpcEndpointId

  ECRRepositoryComplianceWebhookFunction:
    Type: AWS::Serverless::Function
    Description: Lambda handler for amazon-ecr-repository-compliance-webhook
    Metadata:
      BuildMethod: go1.x
    Properties:
      FunctionName: amazon-ecr-repository-compliance-webhook
      Handler: bootstrap
      Runtime: provided.al2023
      Architectures:
      - arm64
      MemorySize: 128
      Role: !Ref ExecutionRole
      Timeout: 15
      Events:
        ValidationEvent:
          Type: Api
          Properties:
            Path: /check-image-compliance
            Method: post
            RestApiId: !Ref ECRRepositoryComplianceWebhookRestApi

  ConfigAPIGatewayLambdaInvoke:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref ECRRepositoryComplianceWebhookFunction
      Principal: apigateway.amazonaws.com

Outputs:
  WebhookURL:
    Description: "ValidatingWebhookConfiguration invocation URL"
    Value: !Sub "https://${ECRRepositoryComplianceWebhookRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/check-image-compliance"