pipeline.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: This template will launch the Modernization Workshop CI/CD Pipeline.

# It should only be necessary to update the parameters	
# run this stack as below but sub for {WORKSHOP NAME} with the workshop/company name and set the value	
# of CloudFrontDistroId resulting from the S3 + CloudFront CloudFormation template.	

# aws cloudformation create-stack --stack-name {WORKSHOP NAME}-Website-Pipeline --template-body file://pipeline.yaml --capabilities CAPABILITY_NAMED_IAM

Parameters:
  ProjectName:
    Type: String
    Description: Project Name
    Default: xxxxxx
  WebsiteBucket:
    Type: String
    Description: Website S3 bucket name
    Default: xxxxxx.awsworkshop.io
  CloudFrontDistroId:
    Type: String
    Description: CloudFront distribution ID
    Default: XXX
  GitHubRepo:
    Type: String
    Description: GitHub repository name
    Default: aws-modernization-with-xXx
  FullRepoURL:
    Type: String
    Description: The full URL to the repo
    Default: https://github.com/aws-samples/aws-modernization-with-xXx.git
  GitHubOwner:
    Type: String
    Description: GitHub owner name
    Default: aws-samples

Resources:
  CodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: CodeBuildService
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource: 
                  - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}-Workshop-website*'
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
              - Resource: !Sub arn:aws:s3:::${ArtifactBucket}/*
                Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:GetObjectVersion
              - Resource: 
                  - !Sub arn:aws:s3:::${WebsiteBucket}/*
                  - !Sub arn:aws:s3:::${WebsiteBucket}
                Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:GetObjectVersion
                  - s3:ListBucket
                  - s3:DeleteObject
                  - s3:DeleteObjectVersion
              - Effect: Allow
                Action:
                  - cloudfront:CreateInvalidation
                Resource: !Sub arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistroId}

  CodePipelineServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codepipeline.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: CodePipelineService
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource:
                  - !Sub arn:aws:s3:::${ArtifactBucket}/*
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
              - Resource: 
                  - !Sub 'arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${ProjectName}-Workshop-website'
                Effect: Allow
                Action:
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds

  ArtifactBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    Properties:
      VersioningConfiguration:
        Status: Enabled 
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: 'AES256'

  ArtifactBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref 'ArtifactBucket'
      PolicyDocument:
        Statement:
        - Action: 's3:*'  
          Effect: Deny
          Resource: 
            - !Join ['', ['arn:aws:s3:::', !Ref 'ArtifactBucket', /*]]
            - !Join ['', ['arn:aws:s3:::', !Ref 'ArtifactBucket']]
          Principal: '*'
          Condition:
            Bool:
              aws:SecureTransport: false

  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: webspec.yml
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:2.0
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: AWS_DEFAULT_REGION
            Value: !Ref AWS::Region
          - Name: FULL_REPO_URL
            Value: !Ref FullRepoURL
          - Name: WEB_SITE_BUCKET
            Value: !Ref WebsiteBucket
          - Name: CLOUDFRONT_DISTRO_ID
            Value: !Ref CloudFrontDistroId
        PrivilegedMode: true
      Name: !Join ['', [!Ref 'ProjectName', '-Workshop-website']]
      ServiceRole: !Ref CodeBuildServiceRole
                     
  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactBucket
      Stages:
        - Name: Source
          Actions:
            - Name: Source
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: '1'
                Provider: GitHub
              Configuration:
                Owner: !Ref GitHubOwner
                Repo: !Ref GitHubRepo
                Branch: main
                OAuthToken: '{{resolve:secretsmanager:GitHub/WorkshopOwnerToken:SecretString:OwnerToken}}'
                PollForSourceChanges: false
              OutputArtifacts:
                - Name: SourceCode
              RunOrder: 1
        - Name: Build
          Actions:
            - Name: Build
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: '1'
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref CodeBuildProject
              InputArtifacts:
                - Name: SourceCode
              OutputArtifacts:
                - Name: BuildOutput
              RunOrder: 1

  GitHubWebhook:
    Type: 'AWS::CodePipeline::Webhook'
    Properties:
      Authentication: GITHUB_HMAC
      AuthenticationConfiguration:
        SecretToken: '{{resolve:secretsmanager:GitHub/WorkshopOwnerToken:SecretString:OwnerToken}}'
      RegisterWithThirdParty: true
      Filters:
      - JsonPath: "$.ref"
        MatchEquals: refs/heads/{Branch}
      TargetPipeline: !Ref Pipeline
      TargetAction: Source
      TargetPipelineVersion: !GetAtt Pipeline.Version

Outputs:
  PipelineUrl:
    Value: !Sub https://console.aws.amazon.com/codepipeline/home?region=${AWS::Region}#/view/${Pipeline}