CI_CD_Pipeline_with_Linter_and_IAM_Validation.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: Enhanced CI/CD Pipeline with Efficient Dependency Management, Parallel Testing, Elastic Build Resources, and Deployment

Resources:
  # CodeCommit Repository
  MyCodeCommitRepository:
    Type: AWS::CodeCommit::Repository
    Properties:
      RepositoryName: MyRepository
      RepositoryDescription: Source repository for the CI/CD pipeline

  # S3 Bucket for CodePipeline Artifacts
  MyArtifactBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-artifact-bucket

  # CodeBuild Project to Install Dependencies
  InstallDependenciesProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: InstallDependenciesProject
      Source:
        Type: CODEPIPELINE
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:5.0
      ServiceRole: !GetAtt CodeBuildServiceRole.Arn
      TimeoutInMinutes: 20
      Cache:
        Type: LOCAL
        Modes:
          - LOCAL_SOURCE_CACHE
          - LOCAL_CUSTOM_CACHE
      BuildSpec: |
        version: 0.2
        phases:
          install:
            commands:
              - pip install -r requirements.txt -t ./dependencies
        artifacts:
          files:
            - '**/*'

  # CodeBuild Project for CloudFormation Linter
  CFNLintBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: CFNLintBuildProject
      Source:
        Type: CODEPIPELINE
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_MEDIUM
        Image: aws/codebuild/standard:5.0
        EnvironmentVariables:
          - Name: CFN_TEMPLATE_FILE
            Value: template.yaml
      ServiceRole: !GetAtt CodeBuildServiceRole.Arn
      TimeoutInMinutes: 20
      BuildSpec: |
        version: 0.2
        phases:
          install:
            commands:
              - cp -r dependencies/* /usr/local/lib/python3.8/site-packages/
          build:
            commands:
              - cfn-lint template.yaml
        artifacts:
          files:
            - '**/*'

  # CodeBuild Project for IAM Policy Validator
  IAMPolicyValidatorBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: IAMPolicyValidatorBuildProject
      Source:
        Type: CODEPIPELINE
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_MEDIUM
        Image: aws/codebuild/standard:5.0
        EnvironmentVariables:
          - Name: CFN_TEMPLATE_FILE
            Value: template.yaml
      ServiceRole: !GetAtt CodeBuildServiceRole.Arn
      TimeoutInMinutes: 20
      BuildSpec: |
        version: 0.2
        phases:
          install:
            commands:
              - cp -r dependencies/* /usr/local/lib/python3.8/site-packages/
          build:
            commands:
              - cfn-policy-validator validate --template-file template.yaml
        artifacts:
          files:
            - '**/*'

  # CodeBuild Project for Unit Tests with Parallel Testing
  UnitTestBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: UnitTestBuildProject
      Source:
        Type: CODEPIPELINE
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_MEDIUM  # Dynamic allocation will handle scaling
        Image: aws/codebuild/standard:5.0
      ServiceRole: !GetAtt CodeBuildServiceRole.Arn
      TimeoutInMinutes: 20
      Cache:
        Type: LOCAL
        Modes:
          - LOCAL_SOURCE_CACHE
          - LOCAL_CUSTOM_CACHE
      BuildSpec: |
        version: 0.2
        phases:
          install:
            commands:
              - cp -r dependencies/* /usr/local/lib/python3.8/site-packages/
          build:
            commands:
              - pytest -n auto --maxfail=1 --disable-warnings  # Run tests in parallel
        artifacts:
          files:
            - '**/*'

  # CodeBuild Project for Deployment
  DeploymentBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: DeploymentBuildProject
      Source:
        Type: CODEPIPELINE
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_MEDIUM  # Dynamic allocation will handle scaling
        Image: aws/codebuild/standard:5.0
      ServiceRole: !GetAtt CodeBuildServiceRole.Arn
      TimeoutInMinutes: 20
      BuildSpec: |
        version: 0.2
        phases:
          install:
            commands:
              - cp -r dependencies/* /usr/local/lib/python3.8/site-packages/
          build:
            commands:
              - echo "Deploying application..."
              - aws cloudformation deploy --template-file template.yaml --stack-name my-stack
        artifacts:
          files:
            - '**/*'

  # CodePipeline
  MyPipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref MyArtifactBucket
      Stages:
        - Name: Source
          Actions:
            - Name: Source
              ActionTypeId:
                Category: Source
                Owner: AWS
                Provider: CodeCommit
                Version: 1
              OutputArtifacts:
                - Name: SourceOutput
              Configuration:
                RepositoryName: !Ref MyCodeCommitRepository
                BranchName: main
        - Name: InstallDependencies
          Actions:
            - Name: InstallDependencies
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              InputArtifacts:
                - Name: SourceOutput
              OutputArtifacts:
                - Name: DependenciesOutput
              Configuration:
                ProjectName: !Ref InstallDependenciesProject
        - Name: CFNLintBuild
          Actions:
            - Name: CFNLintBuild
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              InputArtifacts:
                - Name: DependenciesOutput
              OutputArtifacts:
                - Name: CFNLintBuildOutput
              Configuration:
                ProjectName: !Ref CFNLintBuildProject
        - Name: IAMPolicyValidatorBuild
          Actions:
            - Name: IAMPolicyValidatorBuild
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              InputArtifacts:
                - Name: DependenciesOutput
              OutputArtifacts:
                - Name: IAMPolicyValidatorBuildOutput
              Configuration:
                ProjectName: !Ref IAMPolicyValidatorBuildProject
        - Name: UnitTestBuild
          Actions:
            - Name: UnitTestBuild
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              InputArtifacts:
                - Name: DependenciesOutput
              OutputArtifacts:
                - Name: UnitTestBuildOutput
              Configuration:
                ProjectName: !Ref UnitTestBuildProject
        - Name: Deploy
          Actions:
            - Name: Deploy
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              InputArtifacts:
                - Name: UnitTestBuildOutput
              Configuration:
                ActionMode: CREATE_UPDATE
                StackName: MyStack
                Capabilities: CAPABILITY_IAM
                TemplatePath: UnitTestBuildOutput::template.yaml

  # IAM Role for CodeBuild
  CodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: CodeBuildPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - s3:GetObject
                  - s3:PutObject
                  - s3:GetBucketLocation
                  - codepipeline:PutJobSuccessResult
                  - codepipeline:PutJobFailureResult
                Resource: '*'

  # IAM Role for CodePipeline
  CodePipelineServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: codepipeline.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: CodePipelinePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:*
                  - codecommit:*
                  - codebuild:*
                  - cloudformation:*
                  - iam:PassRole
                Resource: '*'

  # Buildspec for CodeBuild
  CodeBuildBuildspec:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref MyArtifactBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal: '*'
            Action: 's3:GetObject'
            Resource: !Sub 'arn:aws:s3:::${MyArtifactBucket}/*'

  # Launch Template for Build Instances
  BuildLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        ImageId: ami-0abcdef1234567890  # Replace with your AMI ID
        InstanceType: t3.medium
        SecurityGroupIds:
          - !Ref BuildSecurityGroup
        KeyName: my-key-pair  # Replace with your key pair name
      LaunchTemplateName: BuildLaunchTemplate

  # Security Group for Build Instances
  BuildSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for build instances
      VpcId: vpc-12345678  # Replace with your VPC ID

  # Auto Scaling Group
  BuildAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      LaunchTemplate:
        LaunchTemplateId: !Ref BuildLaunchTemplate
        Version: 1
      MinSize: 1
      MaxSize: 5
      DesiredCapacity: 1
      VPCZoneIdentifier:
        - subnet-12345678  # Replace with your subnet ID

  # Scale Up Policy
  ScaleUpPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AutoScalingGroupName: !Ref BuildAutoScalingGroup
      PolicyType: SimpleScaling
      ScalingAdjustment: 1
      Cooldown: 300

  # Scale Down Policy
  ScaleDownPolicy:
    Type: AWS::AutoScaling::ScalingPolicy
    Properties:
      AutoScalingGroupName: !Ref BuildAutoScalingGroup
      PolicyType: SimpleScaling
      ScalingAdjustment: -1
      Cooldown: 300

  # CloudWatch Alarm to Scale Up
  CPUAlarmHigh:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: "Scale-up if CPU > 70%"
      MetricName: CPUUtilization
      Namespace: AWS/EC2
      Statistic: Average
      Period: 300
      EvaluationPeriods: 1
      Threshold: 70
      ComparisonOperator: GreaterThanThreshold
      AlarmActions:
        - !Ref ScaleUpPolicy
      Dimensions:
        - Name: AutoScalingGroupName
          Value: !Ref BuildAutoScalingGroup

  # CloudWatch Alarm to Scale Down
  CPUAlarmLow:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: "Scale-down if CPU < 30%"
      MetricName: CPUUtilization
      Namespace: AWS/EC2
      Statistic: Average
      Period: 300
      EvaluationPeriods: 1
      Threshold: 30
      ComparisonOperator: LessThanThreshold
      AlarmActions:
        - !Ref ScaleDownPolicy
      Dimensions:
        - Name: AutoScalingGroupName
          Value: !Ref BuildAutoScalingGroup

Outputs:
  CodeCommitRepositoryCloneUrl:
    Description: URL to clone the CodeCommit repository
    Value: !GetAtt MyCodeCommitRepository.CloneUrlHttp