sam.yml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Creates resources for github-codebuild-integration
Parameters:
  # see env/example.env about parameters
  GitHubRepositoryUrl:
    Type: String
  GitHubPersonalAccessToken:
    Type: String
  GitHubTargetResource:
    Type: String
  GitHubIgnoreBranchRegex:
    Type: String
  CodeBuildProjectName:
    Type: String
  CodeBuildRegion:
    Type: String
  BuildSkippedBy:
    Type: String

Resources:
  ##########################
  # SNS
  ##########################
  GitHubEventSNSTopic:
    Type: "AWS::SNS::Topic"
  ##########################
  # IAM
  ##########################
  GitHubIAMUser:
    Type: "AWS::IAM::User"
    Properties:
      Policies:
        - PolicyName: !Sub "${CodeBuildProjectName}-github-sns-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action: "sns:Publish"
                Resource: !Ref GitHubEventSNSTopic
  GitHubIAMUserAccessKey:
    Type: "AWS::IAM::AccessKey"
    Properties:
      UserName: !Ref GitHubIAMUser
  ##########################
  # GitHubWebhook(CustomResource)
  ##########################
  GitHubWebhookCustomResourceRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: !Sub "${CodeBuildProjectName}-github-webhook-lambda-execution-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource: "arn:aws:logs:*:*:*"
  GitHubWebhookCustomResource:
    Type: "AWS::Serverless::Function"
    Properties:
      Handler: index.handler
      Role: !GetAtt GitHubWebhookCustomResourceRole.Arn
      CodeUri: ./src/functions/github-webhook-resource
      Runtime: nodejs6.10
      Timeout: 30
      Environment:
        Variables:
          GITHUB_TOKEN: !Ref GitHubPersonalAccessToken
          GITHUB_REPOSITORY_URL: !Ref GitHubRepositoryUrl
          GITHUB_TARGET_RESOURCE: !Ref GitHubTargetResource
          SNS_ACCESS_KEY_ID: !Ref GitHubIAMUserAccessKey
          SNS_SECRET_ACCESS_KEY: !GetAtt GitHubIAMUserAccessKey.SecretAccessKey
          SNS_REGION: !Ref "AWS::Region"
          SNS_TOPIC: !Ref GitHubEventSNSTopic
  GitHubWebhook:
    Type: "Custom::GitHubWebhook"
    Properties:
      ServiceToken: !GetAtt GitHubWebhookCustomResource.Arn
      # Define all variables to re-create GitHub's webhook configuration via `make deploy` when parameters have changed
      GITHUB_TOKEN: !Ref GitHubPersonalAccessToken
      GITHUB_REPOSITORY_URL: !Ref GitHubRepositoryUrl
      GITHUB_TARGET_RESOURCE: !Ref GitHubTargetResource
      SNS_ACCESS_KEY_ID: !Ref GitHubIAMUserAccessKey
      SNS_SECRET_ACCESS_KEY: !GetAtt GitHubIAMUserAccessKey.SecretAccessKey
      SNS_REGION: !Ref "AWS::Region"
      SNS_TOPIC: !Ref GitHubEventSNSTopic
  ##########################
  # Lambda (BuildStateNotifier)
  ##########################
  LambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: !Sub "${CodeBuildProjectName}-lambda-execution-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource: "arn:aws:logs:*:*:*"
  BuildStateNotifier:
    Type: "AWS::Serverless::Function"
    Properties:
      Role: !GetAtt LambdaExecutionRole.Arn
      Handler: index.handler
      Runtime: nodejs6.10
      CodeUri: ./src/functions/build-state-notifier
      Timeout: 10
      MemorySize: 128
      Environment:
        Variables:
          CODEBUILD_PROJECT_REGION: !Ref CodeBuildRegion
          GITHUB_TOKEN: !Ref GitHubPersonalAccessToken
          GITHUB_REPOSITORY_URL: !Ref GitHubRepositoryUrl
      Events:
        CodeBuildStatusChange:
          Type: CloudWatchEvent
          Properties:
            Pattern:
              source:
                - "aws.codebuild"
              detail-type:
                - !Sub "CodeBuild Build State Change"
              detail:
                project-name:
                  - !Ref CodeBuildProjectName
  ##########################
  # Lambda (WebhookHandler)
  ##########################
  WebhookHandlerExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: !Sub "${CodeBuildProjectName}-webhook-handler-execution-role"
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource: "arn:aws:logs:*:*:*"
              - Effect: Allow
                Action:
                  - "codebuild:StartBuild"
                Resource: !Sub "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${CodeBuildProjectName}"
  GitHubWebhookHandler:
    Type: "AWS::Serverless::Function"
    Properties:
      Role: !GetAtt WebhookHandlerExecutionRole.Arn
      Handler: index.handler
      Runtime: nodejs6.10
      CodeUri: ./src/functions/github-webhook-handler
      Timeout: 10
      MemorySize: 128
      Events:
        WebhookReceive:
          Type: SNS
          Properties:
            Topic: !Ref GitHubEventSNSTopic
      Environment:
        Variables:
          DO_NOT_RUN: false
          CODEBUILD_PROJECT_REGION: !Ref CodeBuildRegion
          CODEBUILD_PROJECT_NAME: !Ref CodeBuildProjectName
          GITHUB_TOKEN: !Ref GitHubPersonalAccessToken
          GITHUB_REPOSITORY_URL: !Ref GitHubRepositoryUrl
          GITHUB_TARGET_RESOURCE: !Ref GitHubTargetResource
          GITHUB_IGNORE_BRANCH_REGEX: !Ref GitHubIgnoreBranchRegex
          BUILD_SKIPPED_BY: !Ref BuildSkippedBy
  # We don't use followings anymore but they have to be kept as a workaround for an AWS SAM's bug? that CFn reports 'Circular dependency error' while updating the stack to modify the WebhookHandler's execution role.
  StatesExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - !Sub states.${AWS::Region}.amazonaws.com
            Action: "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: StatesExecutionPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Deny
                Action:
                  - "lambda:InvokeFunction"
                Resource: "*"
  BuildStateMachine:
    Type: "AWS::StepFunctions::StateMachine"
    Properties:
      DefinitionString: !Sub
        |-
          {
            "StartAt": "Wait 10 Seconds",
            "States": {
              "Wait 10 Seconds": {
                "Type": "Wait",
                "Seconds": 10,
                "End": true
              }
            }
          }
      RoleArn: !GetAtt StatesExecutionRole.Arn

Outputs:
  GitHubEventSNSTopic:
    Value: !Ref GitHubEventSNSTopic
  GitHubIAMUserAccessKeyID:
    Value: !Ref GitHubIAMUserAccessKey
  GitHubIAMUserSecretAccessKey:
    Value: !GetAtt GitHubIAMUserAccessKey.SecretAccessKey
  GitHubWebhookID:
    Value: !GetAtt GitHubWebhook.HookId