serverless.yml

service: codedeploy # NOTE: update this with your service name

provider:
  name: aws
#  stage: dev
  region: ap-southeast-2

custom:
  DockerImageArn: <ACCOUNTID>.dkr.ecr.ap-southeast-2.amazonaws.com/codebuild-dotnet-node:latest
  DeploymentFilename: Deployment.zip

resources:
  Resources:
    CodeBuildS3Bucket:
      Type: AWS::S3::Bucket
      Properties:
        VersioningConfiguration:
          Status: Enabled

    CodePipelineS3Bucket:
      Type: AWS::S3::Bucket
      Properties:
        VersioningConfiguration:
          Status: Enabled

    CloudTrailS3Bucket:
      Type: AWS::S3::Bucket

    CloudTrailS3BucketPolicy:
      DependsOn: CloudTrailS3Bucket
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket:
          Ref: CloudTrailS3Bucket
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - 
              Action:
                - "s3:GetBucketAcl"
              Effect: Allow
              Principal:
                Service: "cloudtrail.amazonaws.com"
              Resource:
                Fn::Join:
                  - ''
                  - - "arn:aws:s3:::"
                    - { Ref: CloudTrailS3Bucket }
            -
              Action:
                - "s3:PutObject"
              Effect: Allow
              Principal:
                Service: "cloudtrail.amazonaws.com"
              Resource: 
                Fn::Join:
                  - ''
                  - - "arn:aws:s3:::"
                    - { Ref: CloudTrailS3Bucket }
                    - "/*"           
              Condition:
                StringEquals:
                  s3:x-amz-acl: "bucket-owner-full-control"

    CodeBuildIAMRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - 
              Effect: Allow
              Principal:
                Service:
                  - codebuild.amazonaws.com
              Action: "sts:AssumeRole"
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/AdministratorAccess

    CodePipelineIAMRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - 
              Effect: Allow
              Principal:
                Service:
                  - codepipeline.amazonaws.com
              Action: "sts:AssumeRole"
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/AmazonS3FullAccess
          - arn:aws:iam::aws:policy/AWSCodePipelineFullAccess
          - arn:aws:iam::aws:policy/AWSCodeBuildDeveloperAccess

    CloudWatchIAMRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - 
              Effect: Allow
              Principal:
                Service:
                  - events.amazonaws.com
              Action: "sts:AssumeRole"
        Policies:
          - PolicyName: "CodePipelineExecution"
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: Allow
                  Action:
                    - codepipeline:StartPipelineExecution
                  Resource: "*"

    CodeBuildProject:
      Type: AWS::CodeBuild::Project
      Properties:
        Artifacts:
          Type: NO_ARTIFACTS
        Source:
          BuildSpec: buildSpec.yml
          Type: S3
          Location:
            Fn::Join:
              - ''
              - - Ref: CodeBuildS3Bucket
                - /
                - ${self:custom.DeploymentFilename}
        ServiceRole: 
          Fn::GetAtt: [ CodeBuildIAMRole , Arn ]
        Environment:
          Type: LINUX_CONTAINER
          Image: ${self:custom.DockerImageArn}
          ComputeType: BUILD_GENERAL1_SMALL
          EnvironmentVariables:
            -
              Name: STAGE
              Value: ${opt:stage, 'dev'}

    CodePipelinePipeline:
      Type: AWS::CodePipeline::Pipeline
      Properties:
        RoleArn:
          Fn::GetAtt: [ CodePipelineIAMRole , Arn ]
        ArtifactStore:
          Location:
            Ref: CodePipelineS3Bucket
          Type: S3
        Stages:
          - 
            Name: Source
            Actions: 
              -
                Name: Source
                ActionTypeId:
                  Category: Source
                  Owner: AWS
                  Provider: S3
                  Version: 1
                OutputArtifacts:
                  -
                    Name: SourceArtifact
                Configuration:
                  S3Bucket:
                    Ref: CodeBuildS3Bucket
                  PollForSourceChanges: false
                  S3ObjectKey: ${self:custom.DeploymentFilename}
          - 
            Name: Build
            Actions: 
              -
                Name: Build
                InputArtifacts:
                  - 
                    Name: SourceArtifact
                ActionTypeId:
                  Category: Build
                  Owner: AWS
                  Provider: CodeBuild
                  Version: 1
                OutputArtifacts:
                  -
                    Name: BuildArtifact
                Configuration:
                  ProjectName:
                    Ref: CodeBuildProject

    CodePipelineTrigger:
      Type: AWS::Events::Rule
      Properties:
        State: ENABLED
        EventPattern: 
          source:
            - "aws.s3"
          detail-type:
            - "AWS API Call via CloudTrail"
          detail:
            eventSource:
              - "s3.amazonaws.com"
            eventName:
              - "PutObject"
              - "CompleteMultipartUpload"
            resources:
              ARN:
                - Fn::Join:
                    - ''
                    - - Fn::GetAtt: [ CodeBuildS3Bucket , Arn ]
                      - '/'
                      - ${self:custom.DeploymentFilename}
        Targets:
          -
            Arn:
              Fn::Join:
                - ':'
                - - arn:aws:codepipeline
                  - { Ref: AWS::Region }
                  - { Ref: AWS::AccountId }
                  - { Ref: CodePipelinePipeline }
            RoleArn: 
              Fn::GetAtt: [ CloudWatchIAMRole , Arn ]
            Id:
              Ref: CodePipelinePipeline

    CloudTrailTrail:
      Type: AWS::CloudTrail::Trail
      DependsOn: CloudTrailS3BucketPolicy
      Properties:
        IsLogging: true
        S3BucketName:
          Ref: CloudTrailS3Bucket
        EventSelectors:
          - ReadWriteType: WriteOnly
            IncludeManagementEvents: false
            DataResources:
              - Type: AWS::S3::Object
                Values:
                  - Fn::Join:
                      - ''
                      - - "arn:aws:s3:::"
                        - { Ref: CodeBuildS3Bucket}
                        - "/"
                        - ${self:custom.DeploymentFilename}

  Outputs: 
    CodeBuildS3Bucket:
      Value:
        Ref: CodeBuildS3Bucket

    CodeBuildIAMRole:
      Value:
        Fn::GetAtt: [ CodeBuildIAMRole , Arn ]

    CodeBuildProject:
      Value:
        Ref: CodeBuildProject