pipeline.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: CodePipeline uses CodeBuild and GitHub

Parameters:

  GitHubOwner:
    Type: String
    Description: Name of the GitHub repository owner, for example, your company's GitHub name. This is not the repo name.

  GitHubRepoName:
    Type: String
    Description: Name of the GitHub Repo that this pipeline should interact with

  GitHubBranchName:
    Type: String
    Description: Name of the GitHub branch that should trigger the pipeline

  GitHubConnectionArn:
    Type: String
    Description: ARN for the GitHub Connection v2 set up in the account in CodePipeline

  PipelineArtifactsBucketName:
    Type: String
    Description: Create a name for a bucket that will store the pipeline artifacts (this bucket is created with this template)
    Default: demo-pipeline-artifacts

  ProductName:
    Type: String

  DeployRegion:
    Type: String
    Default: us-west-2

  Environment:
    Type: String

  TargetAccountForCFnDeployment:
    Type: String
    Description: >
      This pipeline deploys a CloudFormation template into an AWS Account. It is currently not set up for cross-account deployment.
      This parameter should be the account number that the CloudFormation template should be deployed into.

  PipelineName:
    Type: String
    Description: >
      Create a descriptive and friendly name for the pipeline. Do not include the environment (such as dev),
      as this will be added to the name automatically.


Resources:

  #------- CodeBuild -------
  DemoCodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Description: Does something
      EncryptionKey: !GetAtt CMKKeyForPipeline.Arn
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:2.0
        EnvironmentVariables:
        - Name: ROLE
          Value: ""
        - Name: DEPLOY_REGION
          Value: ""
      LogsConfig:
        CloudWatchLogs:
          Status: "ENABLED"
      Name: !Sub DemoBuildProject-${Environment}
      ServiceRole: !GetAtt DemoPipelineCodeBuildRole.Arn
      TimeoutInMinutes: 10
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                python: 3.7
            build:
              commands:
                - echo "Checking current working directory"
                - ls

  CodeBuildCfnNagScan:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub CodeBuild-CfnNag-Scan-${Environment}
      Description: Independent CfnNag scan project for post build artifacts
      Artifacts:
        Type: CODEPIPELINE
      EncryptionKey: !GetAtt CMKKeyForPipeline.Arn
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:2.0
      LogsConfig:
        CloudWatchLogs:
          Status: "ENABLED"
      ServiceRole: !GetAtt DemoPipelineCodeBuildRole.Arn
      TimeoutInMinutes: 10
      Source:
        Type: CODEPIPELINE # specifies the source code settings for the project, such as the source code's repository type and location - source code placed in S3 bucket.
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                ruby: 2.6
              commands:
                - echo "Installing cfn_nag utility - `pwd`"
                - gem install cfn-nag
                - cfn_nag -v
                - echo "cfn_nag utility installation complete `date`"
            build:
              commands:
                - echo "Starting cfn_nag scanning `date` in `pwd`"
                - for y in `find deployment/dist/* -name "*.template"`; do echo "============= $y ================" ; cfn_nag --fail-on-warnings $y || ec1=$?; done
                - if [ "$ec1" -ne "0" ]; then echo 'ERROR-1'; else echo 'SUCCESS-1'; ec1=0; fi
                - echo "Exit Code 1 `echo $ec1`"
                - for y in `find deployment/global-s3-assets/* -name "*.template"`; do echo "============= $y ================" ; cfn_nag --fail-on-warnings $y || ec2=$?; done
                - if [ "$ec2" -ne "0" ]; then echo 'ERROR-2'; else echo 'SUCCESS-2'; ec2=0; fi
                - echo "Exit Code 2 `echo $ec2`"
                - echo "Completed cfn_nag scanning `date`"
                - echo "Analyze exit codes and exit"
                - if [ "$ec1" -ne "0" ] || [ "$ec2" -ne "0" ]; then echo 'ERROR'; ec=1; else echo 'SUCCESS'; ec=0; fi;
                - echo "Exit Code Final `echo $ec`"
                - exit $ec
          artifacts:
            files:
              - '**/*'

  CodeBuildDeployCFnS3Bucket:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub DeployCloudFormationTemplate-${Environment}
      Description: Deploys an S3 bucket with CloudFormation stack
      ServiceRole: !GetAtt DemoPipelineCodeBuildRole.Arn
      TimeoutInMinutes: 60
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/docker:18.09.0
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: ROLE
            Value: ""
          - Name: DEPLOY_REGION
            Value: ""
          - Name: TEMPLATE_FILE
            Value: ""
          - Name: PARAMETER_FILE
            Value: ""
          - Name: STACKPREFIX
            Value: ""
      LogsConfig:
        CloudWatchLogs:
          Status: ENABLED
          GroupName: !Ref DeployCodePipelineCloudformationLogGroup
      Source:
        Type: CODEPIPELINE
        BuildSpec: !Sub |
          version: 0.2
          phases:
            install:
              commands:
                - sudo apt-get update
                - sudo apt-get -y install unzip jq
            pre_build:
              commands:
                - PRODUCTNAME=${ProductName}
                - STACKNAME=$STACKPREFIX$PRODUCTNAME
                - printenv
                - ls -lha
                - cat "./s3-bucket.yaml"
                - cp $TEMPLATE_FILE template.yaml
                - cp $PARAMETER_FILE parameters.json

            build:
              commands:
                - DEPLOY_CREDENTIALS=$(aws sts assume-role --role-arn $ROLE --role-session-name codebuild-session)
                - export AWS_ACCESS_KEY_ID=$(echo $DEPLOY_CREDENTIALS | jq .Credentials.AccessKeyId | xargs)
                - export AWS_SECRET_ACCESS_KEY=$(echo $DEPLOY_CREDENTIALS | jq .Credentials.SecretAccessKey | xargs)
                - export AWS_SESSION_TOKEN=$(echo $DEPLOY_CREDENTIALS | jq .Credentials.SessionToken | xargs)

                - aws cloudformation describe-stacks --region $DEPLOY_REGION --stack-name $STACKNAME > describe_stack.log || true
                - |
                  if [ -s describe_stack.log ] && [ "$(jq -r .Stacks[0].StackStatus describe_stack.log)" = "ROLLBACK_COMPLETE" ]; then
                  echo "Old stack is in \"ROLLBACK_COMPLETE\" state. Deleting old stack"
                  aws cloudformation delete-stack --stack-name $STACKNAME --region $DEPLOY_REGION
                  aws cloudformation wait stack-delete-complete --stack-name $STACKNAME --region $DEPLOY_REGION
                  fi
                - TIMESTAMP=$(date -u "+%Y-%m-%dT%H:%M:%S")
                - >
                  aws cloudformation deploy --template-file template.yaml \
                      --capabilities CAPABILITY_NAMED_IAM \
                      --role-arn $ROLE \
                      --stack-name $STACKNAME \
                      --region $DEPLOY_REGION \
                      --no-fail-on-empty-changeset \
                      --parameter-overrides file://parameters.json ||
                      (aws cloudformation describe-stack-events \
                          --stack-name $STACKNAME \
                          --output table \
                          --region $DEPLOY_REGION \
                          --query "StackEvents[?Timestamp >= \`$TIMESTAMP\`].[Timestamp,ResourceType,LogicalResourceId,ResourceStatus,ResourceStatusReason]" && false)
            post_build:
              commands:
                - aws cloudformation describe-stacks --stack-name $STACKNAME --query 'Stacks[*].Outputs' | jq '.[]' > ./cloudformation-outputs.json
                - cat "./cloudformation-outputs.json"
          artifacts:
            files:
              - '**/*'

  CodeBuildTestDeployment:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Name: !Sub CodeBuildTestDeploy-${Environment}
      Description: Runs tests after deployment of CloudFormation
      EncryptionKey: !GetAtt CMKKeyForPipeline.Arn
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:2.0
        EnvironmentVariables:
        - Name: ROLE
          Value: ""
        - Name: DEPLOY_REGION
          Value: ""
      LogsConfig:
        CloudWatchLogs:
          Status: "ENABLED"
      ServiceRole: !GetAtt DemoPipelineCodeBuildRole.Arn
      TimeoutInMinutes: 10
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                python: 3.7
            build:
              commands:
                - echo "Checking current working directory"
                - ls
                - echo "Running tests"
                - cat "./cloudformation-outputs.json"
                - echo "Tests passed"

  #------- CodePipeline -------
  DemoPipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      ArtifactStore:
        Type: S3
        EncryptionKey:
          Id: !GetAtt CMKKeyForPipeline.Arn
          Type: KMS
        Location: !Ref CodePipelineS3Bucket
      RoleArn: !GetAtt DemoPipelineRole.Arn
      Name: !Sub ${PipelineName}-${Environment}
      Stages:
        - Name: GitHubSource
          Actions:
            - Name: SourceCodeStar
              ActionTypeId:
                Category: Source
                Owner: AWS
                Version: "1"
                Provider: CodeStarSourceConnection
              Configuration:
                ConnectionArn: !Ref GitHubConnectionArn
                FullRepositoryId: !Sub "${GitHubOwner}/${GitHubRepoName}"
                BranchName: !Ref GitHubBranchName
              OutputArtifacts:
                - Name: SourceOutput
              RunOrder: 1

        - Name: DirectoryList
          Actions:
            - Name: DirectoryList
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: '1'
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref DemoCodeBuildProject
              RunOrder: 1
              InputArtifacts:
                - Name: SourceOutput

        - Name: CfnNagScan
          Actions:
            - Name: CfnNagScan
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: '1'
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref CodeBuildCfnNagScan
              RunOrder: 1
              InputArtifacts:
                - Name: SourceOutput
              OutputArtifacts:
                - Name: CfnNagScanArtifact

        - Name: ManualApproval
          Actions:
            - Name: ManualApproval
              ActionTypeId:
                Category: Approval
                Owner: AWS
                Provider: Manual
                Version: "1"
              Configuration:
                CustomData: "Approval will lead to the deployment of a CloudFormation Stack"
              RunOrder: 1

        - Name: DeployCloudFormationToDev
          Actions:
            - Name: DeployCloudFormation
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: "1"
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref CodeBuildDeployCFnS3Bucket
                EnvironmentVariables: !Sub | # Uses DeploymentRole, which is created with a cloudformation template called "deployment-role.yaml"
                  [
                    {
                      "name": "ROLE",
                      "value": "arn:aws:iam::${TargetAccountForCFnDeployment}:role/DeploymentRole"
                    },
                    {
                      "name": "DEPLOY_REGION",
                      "value": "${DeployRegion}"
                    },
                    {
                      "name": "TEMPLATE_FILE",
                      "value": "./s3-bucket.yaml"
                    },
                    {
                      "name": "PARAMETER_FILE",
                      "value": "./parameters/dev.json"
                    },
                    {
                      "name": "STACKPREFIX",
                      "value": "${Environment}-"
                    }
                  ]
              RunOrder: 1
              InputArtifacts:
                - Name: SourceOutput
              OutputArtifacts:
                - Name: CFnOutput

        - Name: TestDeployment
          Actions:
            - Name: TestDeployment
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: '1'
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref CodeBuildTestDeployment
              RunOrder: 1
              InputArtifacts:
                - Name: CFnOutput


  #------- LogGroup -------
  DeployCodePipelineCloudformationLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub CodeBuildDeployCloudformationDemoLogGroup--${Environment}
      RetentionInDays: 30

  #------- Encryption -------
  CMKKeyForPipeline:
    Type: AWS::KMS::Key
    Properties:
      Description: "CMK to encrypt Pipeline"
      KeyPolicy:
        Version: "2012-10-17"
        Id: "key-default-1"
        Statement:
          - Sid: "Enable IAM User Permissions"
            Effect: "Allow"
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action: "kms:*"
            Resource: "*" # refers to this CMK
          - Sid: "Allow use of the key"
            Effect: "Allow"
            Principal: "*"
            Action:
              - "kms:DescribeKey"
              - "kms:Encrypt"
              - "kms:Decrypt"
              - "kms:ReEncrypt*"
              - "kms:GenerateDataKey"
              - "kms:GenerateDataKeyWithoutPlaintext"
              - "kms:CreateGrant"
            Resource: "*"

  CMKAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub alias/DemoPipelineCMK/${Environment}
      TargetKeyId:
        Ref: CMKKeyForPipeline

  #------- Encrypted Bucket for Pipeline Artifacts-------
  CodePipelineS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${PipelineArtifactsBucketName}-${Environment}
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !Ref CMKKeyForPipeline

  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref CodePipelineS3Bucket
      PolicyDocument:
        Statement:
          - Sid: DenyUnEncryptedObjectUploads
            Effect: Deny
            Principal: "*"
            Action:
              - s3:PutObject
            Resource:
              - !Sub arn:aws:s3:::${PipelineArtifactsBucketName}-${Environment}/*
            Condition:
              StringNotEquals:
                s3:x-amz-server-side-encryption: aws:kms
          - Sid: DenyInsecureConnections
            Effect: Deny
            Principal: "*"
            Action: "s3:*"
            Resource:
              - !Sub arn:aws:s3:::${PipelineArtifactsBucketName}-${Environment}/*
            Condition:
              Bool:
                aws:SecureTransport: false

  #------- IAM Permissions -------
  DemoPipelineCodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEC2FullAccess
      Path: /

  DemoPipelineCodeBuildPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub DemoCodeBuildPipelinePolicy-${Environment}
      Roles:
        - !Ref DemoPipelineCodeBuildRole
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: CloudWatchLogsPolicy
            Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource: "*"
          - Sid: S3Policy
            Effect: Allow
            Action:
              - s3:GetObject
              - s3:GetObjectVersion
              - s3:PutObject
              - s3:GetBucketAcl
              - s3:GetBucketLocation
            Resource: "*"
          - Sid: RolePermissions
            Effect: Allow
            Action:
              - iam:PassRole
              - iam:ListInstanceProfiles
            Resource:
              - "*"
          - Sid: AssumeRolePermissions
            Effect: Allow
            Action:
              - sts:AssumeRole
            Resource:
              - "arn:aws:iam::*:role/DeploymentRole"
          - Effect: Allow
            Action:
              - kms:Encrypt,
              - kms:Decrypt,
              - kms:ReEncrypt*,
              - kms:GenerateDataKey*,
              - kms:DescribeKey,
              - kms:CreateGrant
            Resource: "*"

  DemoPipelineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCodePipelineFullAccess
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
        - arn:aws:iam::aws:policy/AWSCodeDeployFullAccess
        - arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess
      Path: /

  DemoPipelinePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub DemoPipelinePolicy-${AWS::Region}
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - iam:ListRoles
              - iam:PassRole
              - cloudformation:*
              - codebuild:BatchGetBuilds
              - codebuild:StartBuild
            Resource:
              - "*"
      Roles:
        - !Ref DemoPipelineRole