cicd.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: CI/CD infrastructure for a simple calculator application
Parameters:
  codeBucket:
    Description: S3 Bucket where functions.zip and calculator.zip are stored.
    Type: String
  EnvironmentName:
    Description: An environment name that will be prefixed to resource names
    Type: String
    Default: CI-CD
  VpcCIDR:
    Description: IP range (CIDR notation) for the VPC
    Type: String
    Default: 192.168.0.0/16
    AllowedPattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}(\/([1][6-9]|[2][0-8]))$
  PublicSubnet1CIDR:
    Description: IP range (CIDR notation) for the PUBLIC subnet in the FIRST Availability Zone
    Type: String
    Default: 192.168.0.0/20
    AllowedPattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}(\/([1][6-9]|[2][0-8]))$
  PrivateSubnet1CIDR:
    Description: IP range (CIDR notation) for the PRIVATE subnet in the SECOND Availability Zone
    Type: String
    Default: 192.168.64.0/20
    AllowedPattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}(\/([1][6-9]|[2][0-8]))$
  PublicSubnet2CIDR:
    Description: IP range (CIDR notation) for the PUBLIC subnet in the SECOND Availability Zone
    Type: String
    Default: 192.168.16.0/20
    AllowedPattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}(\/([1][6-9]|[2][0-8]))$
  ApplicationName:
    Description: An application name that will be prefixed to resource names
    Type: String
    Default: simple-calculator
  LatestAmiId:
    Description: The AWS::EC2::Image::Id that will be pulled from AWS System Manager parameter store (Publicly Available on AWS) to be used for application instances
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64
  OutputsPrefix:
    Description: The prefix for stack outputs that will be used for the pipeline resources
    Type: String
    Default: shared-resources
Metadata:
  # Parameter formatting to help explain what parameters need to be changed.
  # codeBucket is the only parameter not having a default value because in this project I
  # create the S3 bucket and upload the files (functions.zip and calculator.zip) into it using the
  # AWS CLI from my AWS Cloudshell (You can access and use it in your browser from your management console)
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: Required Parameters
      Parameters:
      - codeBucket
    - Label:
        default: Other Parameters
      Parameters:
      - EnvironmentName
      - VpcCIDR
      - PublicSubnet1CIDR
      - PublicSubnet2CIDR
      - PrivateSubnet1CIDR
      - ApplicationName
      - LatestAmiId
      - OutputsPrefix
    ParameterLabels:
      codeBucket:
        default: Bucket where functions.zip and calculator.zip are stored
      EnvironmentName:
        default: An environment name that will be prefixed to resource names
      VpcCIDR:
        default: IP range (CIDR notation) for the VPC
      PublicSubnet1CIDR:
        default: IP range (CIDR notation) for the PUBLIC subnet in the FIRST Availability Zone
      PublicSubnet2CIDR:
        default: IP range (CIDR notation) for the PUBLIC subnet in the SECOND Availability Zone
      PrivateSubnet1CIDR:
        default: IP range (CIDR notation) for the PRIVATE subnet in the SECOND Availability Zone
      ApplicationName:
        default: An application name that will be prefixed to resource names
      LatestAmiId:
        default: The AWS::EC2::Image::Id that will be pulled from parameter store to be used for application instances
      OutputsPrefix:
        default: The prefix for stack outputs that will be used for your pipeline resources
Resources:
  # Code Repository for the simple Calculator application (CodeCommit Repo)
  CodeCommitRepo:
    Type: AWS::CodeCommit::Repository
    Properties:
      RepositoryName: !Ref EnvironmentName
      RepositoryDescription: Calculator application repository
      Code:
        S3:
          Bucket: !Sub ${codeBucket}
          Key: calculator.zip

  # Shared Network Resources for the application environments (Test & Prod)
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
      - Key: Name
        Value: !Sub ${EnvironmentName} VPC
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
      - Key: Name
        Value: !Sub ${EnvironmentName} IG
  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone:
        Fn::Select:
        - 0
        - Fn::GetAZs: ""
      CidrBlock: !Ref PublicSubnet1CIDR
      MapPublicIpOnLaunch: true
      Tags:
      - Key: Name
        Value: !Sub ${EnvironmentName} Public Subnet 1
  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone:
        Fn::Select:
        - 1
        - Fn::GetAZs: ""
      CidrBlock: !Ref PublicSubnet2CIDR
      MapPublicIpOnLaunch: true
      Tags:
      - Key: Name
        Value: !Sub ${EnvironmentName} Public Subnet 2
  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone:
        Fn::Select:
        - 0
        - Fn::GetAZs: ""
      CidrBlock: !Ref PrivateSubnet1CIDR
      MapPublicIpOnLaunch: false
      Tags:
      - Key: Name
        Value: !Sub ${ApplicationName} Private Subnet 1
  NatGateway1EIP:
    Type: AWS::EC2::EIP
    DependsOn: InternetGatewayAttachment
    Properties:
      Domain: vpc
  NatGateway1:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGateway1EIP.AllocationId
      SubnetId: !Ref PublicSubnet2
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: !Sub ${EnvironmentName} Public Routes
  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet1
  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet2
  PrivateRouteTable1:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: !Sub ${ApplicationName} Private Routes 1
  DefaultPrivateRoute1:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway1
  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      SubnetId: !Ref PrivateSubnet1
  PublicHttpIngressSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group that allows HTTP ingress from internet
      GroupName: public-http-ingress-sg
      VpcId: !Ref VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: 0.0.0.0/0
  PrivateHttpIngressSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: private-http-ingress-sg
      GroupDescription: Security group that allows HTTP ingress from load balancer
      VpcId: !Ref VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 8080
        ToPort: 8080
        SourceSecurityGroupId:
          Ref: PublicHttpIngressSecurityGroup

  # CodeBuild Project to build the application and run unit tests
  CodeBuildProject:
    DependsOn:
    - CodeBuildPolicy
    Properties:
      Artifacts:
        Location: !Ref ArtifactsBucket
        Name: build-output.zip
        NamespaceType: BUILD_ID
        Packaging: ZIP
        Path: codebuild
        Type: S3
      Cache:
        Location: !Ref CacheBucket
        Type: S3
      Description: !Sub CodeBuild Project for ${AWS::StackName}
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/nodejs:8.11.0
        Type: LINUX_CONTAINER
      Name: !Ref AWS::StackName
      ServiceRole: !Ref CodeBuildRole
      Source:
        Type: CODECOMMIT
        Location: !GetAtt CodeCommitRepo.CloneUrlHttp
        BuildSpec: buildspec.yml
    Type: AWS::CodeBuild::Project

  # IAM Resources for the CI/CD pipeline
  CloudFormationTrustRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - cloudformation.amazonaws.com
      Path: /
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - iam:CreateInstanceProfile
            - iam:DeleteInstanceProfile
            - iam:GetRole
            - iam:GetInstanceProfile
            - iam:RemoveRoleFromInstanceProfile
            - iam:UpdateRoleDescription
            - iam:CreateRole
            - iam:DeleteRole
            - iam:AttachRolePolicy
            - iam:PutRolePolicy
            - iam:ListInstanceProfiles
            - iam:AddRoleToInstanceProfile
            - iam:ListInstanceProfilesForRole
            - iam:PassRole
            - iam:DetachRolePolicy
            - iam:DeleteRolePolicy
            - iam:ListRolePolicies
            - iam:ListRoles
            - iam:GetRolePolicy
            Effect: Allow
            Resource:
            - !Sub arn:aws:iam::*:role/${AWS::StackName}*
            - !Sub arn:aws:iam::*:instance-profile/${AWS::StackName}*
          - Action:
            - iam:CreateServiceLinkedRole
            Effect: Allow
            Resource:
            - arn:aws:iam::*:role/aws-service-role/*
          - Action:
            - ssm:GetParameters
            - autoscaling:*
            - ec2:*
            - codedeploy:*
            - elasticloadbalancing:*
            Effect: Allow
            Resource:
            - "*"
        PolicyName: !Sub ${AWS::StackName}-CloudFormationRolePolicy
      RoleName: !Sub ${AWS::StackName}-CloudFormation
    Type: AWS::IAM::Role
  LambdaCodePipelineExecutionPolicy:
    DependsOn:
    - CloudFormationTrustRole
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: LambdaRolePolicy
      Roles:
      - !Ref CodePipelineLambdaRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Action:
          - logs:*
          Resource:
          - arn:aws:logs:*:*:*
        - Effect: Allow
          Action:
          - codepipeline:PutJobSuccessResult
          - codepipeline:PutJobFailureResult
          - s3:*
          - ec2:*
          - cloudformation:*
          Resource:
          - "*"
        - Effect: Allow
          Action:
          - dynamodb:*
          Resource:
          - "*"
  CodeBuildPolicy:
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - logs:CreateLogGroup
          - logs:CreateLogStream
          - logs:PutLogEvents
          Effect: Allow
          Resource: "*"
        - Action:
          - s3:PutObject
          - s3:GetObject
          - s3:GetObjectVersion
          Effect: Allow
          Resource:
          - !GetAtt ArtifactsBucket.Arn
          - !Sub ${ArtifactsBucket.Arn}/*
          - !GetAtt CacheBucket.Arn
          - !Sub ${CacheBucket.Arn}/*
        - Action:
          - codecommit:GitPull
          Effect: Allow
          Resource: !GetAtt CodeCommitRepo.Arn
        - Action:
          - kms:GenerateDataKey*
          - kms:Encrypt
          - kms:Decrypt
          Effect: Allow
          Resource: !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/aws/s3
      PolicyName: !Sub ${AWS::StackName}-CodeBuildPolicy
      Roles:
      - !Ref CodeBuildRole
    Type: AWS::IAM::Policy
  CodeBuildRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: codebuild.amazonaws.com
      Path: /
      RoleName: !Sub ${AWS::StackName}-CodeBuild
    Type: AWS::IAM::Role
  CodePipelineLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: /
  CodePipelineTrustRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - codepipeline.amazonaws.com
          Sid: 1
      Path: /
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - s3:GetObject
            - s3:GetObjectVersion
            - s3:GetBucketVersioning
            - s3:PutObject
            Effect: Allow
            Resource:
            - !GetAtt ArtifactsBucket.Arn
            - !Sub ${ArtifactsBucket.Arn}/*
          - Action:
            - codecommit:CancelUploadArchive
            - codecommit:GetBranch
            - codecommit:GetCommit
            - codecommit:GetUploadArchiveStatus
            - codecommit:UploadArchive
            Effect: Allow
            Resource:
            - !GetAtt CodeCommitRepo.Arn
          - Action:
            - codebuild:StartBuild
            - codebuild:BatchGetBuilds
            - codebuild:StopBuild
            Effect: Allow
            Resource:
            - !GetAtt CodeBuildProject.Arn
          - Action:
            - codedeploy:CreateDeployment
            - codedeploy:GetApplicationRevision
            - codedeploy:GetDeployment
            - codedeploy:GetDeploymentConfig
            - codedeploy:RegisterApplicationRevision
            Effect: Allow
            Resource:
            - !Sub arn:aws:codedeploy:${AWS::Region}:${AWS::AccountId}:deploymentgroup:${AWS::StackName}*
            - !Sub arn:aws:codedeploy:${AWS::Region}:${AWS::AccountId}:application:${AWS::StackName}*
            - !Sub arn:aws:codedeploy:${AWS::Region}:${AWS::AccountId}:deploymentconfig:*
          - Action:
            - cloudformation:CreateStack
            - cloudformation:DescribeStacks
            - cloudformation:DescribeStackEvents
            - cloudformation:DeleteStack
            - cloudformation:UpdateStack
            - cloudformation:CreateChangeSet
            - cloudformation:ExecuteChangeSet
            - cloudformation:DeleteChangeSet
            - cloudformation:DescribeChangeSet
            - cloudformation:SetStackPolicy
            Effect: Allow
            Resource:
            - !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}*
          - Action:
            - iam:PassRole
            Effect: Allow
            Resource:
            - !GetAtt CloudFormationTrustRole.Arn
          - Action:
            - lambda:InvokeFunction
            Effect: Allow
            Resource: "*"
        PolicyName: !Sub ${AWS::StackName}-CodePipelineRolePolicy
      RoleName: !Sub ${AWS::StackName}-CodePipeline
    Type: AWS::IAM::Role
  CodeDeployRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - codedeploy.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
      - PolicyName: allow-autoscaling
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action:
            - ec2:*
            - autoscaling:*
            Resource: "*"
  InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
            - codedeploy.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
      - PolicyName: allow-deployment-bucket
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action:
            - s3:GetObject
            - s3:GetObjectVersion
            Resource:
            - !Sub ${ArtifactsBucket.Arn}/*
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
      - Ref: InstanceRole
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: /
      Policies:
      - PolicyName: !Sub lambdaLogsCreatePolicy-${AWS::StackName}
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*
      - PolicyName: !Sub lambdaLogPolicy-${AWS::StackName}
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource:
            - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*:*
  SourceEventRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - events.amazonaws.com
          Sid: 1
      Path: /
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - codepipeline:StartPipelineExecution
            Effect: Allow
            Resource:
            - !Sub arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${EnvironmentName}-releasePipeline
        PolicyName: !Sub ${EnvironmentName}-CloudWatchEventPolicy
      RoleName: !Sub ${EnvironmentName}-CloudWatchEventRule
    Type: AWS::IAM::Role

  # Static Code Analysis Lambda function
  CFNValidateLambda:
    Type: AWS::Lambda::Function
    DependsOn:
    - LambdaCodePipelineExecutionPolicy
    - DBRules
    Properties:
      Code:
        S3Bucket: !Ref codeBucket
        S3Key: functions.zip
      Role: !GetAtt CodePipelineLambdaRole.Arn
      Description: Checks the CloudFormation template for known violations
      Timeout: 60
      Handler: cfn_validate_lambda.lambda_handler
      Runtime: python3.8
      TracingConfig:
        Mode: Active

  # Service Status Lambda function for synthetic testing
  servicestatus:
    Type: AWS::Lambda::Function
    DependsOn:
    - LambdaCodePipelineExecutionPolicy
    Properties:
      Code:
        S3Bucket: !Ref codeBucket
        S3Key: functions.zip
      Role: !GetAtt CodePipelineLambdaRole.Arn
      Description: Test to check url passed in the event for a 200 status code
      Timeout: 60
      Handler: index.handler
      Runtime: nodejs16.x
      TracingConfig:
        Mode: Active

  # S3 Buckets and policy to hold build artifacts
  ArtifactBucketPolicy:
    Properties:
      Bucket: !Ref ArtifactsBucket
      PolicyDocument:
        Id: SSEAndSSLPolicy
        Statement:
        - Action:
          - s3:GetObject
          - s3:GetObjectVersion
          - s3:GetBucketVersioning
          Condition:
            Bool:
              aws:SecureTransport: false
          Effect: Allow
          Principal:
            AWS:
            - !GetAtt CodePipelineTrustRole.Arn
            - !GetAtt CodeBuildRole.Arn
            - !GetAtt CloudFormationTrustRole.Arn
          Resource:
          - !GetAtt ArtifactsBucket.Arn
          - !Sub ${ArtifactsBucket.Arn}/*
          Sid: WhitelistedGet
        - Action:
          - s3:PutObject
          Effect: Allow
          Principal:
            AWS:
            - !GetAtt CodePipelineTrustRole.Arn
            - !GetAtt CodeBuildRole.Arn
          Resource:
          - !GetAtt ArtifactsBucket.Arn
          - !Sub ${ArtifactsBucket.Arn}/*
          Sid: WhitelistedPut
        Version: 2012-10-17
    Type: AWS::S3::BucketPolicy
  ArtifactsBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    Properties:
      LifecycleConfiguration:
        Rules:
        - ExpirationInDays: 7
          Status: Enabled
  CacheBucket:
    DeletionPolicy: Delete
    Properties:
      LifecycleConfiguration:
        Rules:
        - ExpirationInDays: 3
          Status: Enabled
    Type: AWS::S3::Bucket

  # Dynamodb table for static code analysis rules
  DBRules:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
      - AttributeName: rule
        AttributeType: S
      KeySchema:
      - AttributeName: rule
        KeyType: HASH

  # CodeDeploy Application to install the application to ec2 instances
  CodeDeployApplication:
    Properties:
      ApplicationName: !Ref AWS::StackName
    Type: AWS::CodeDeploy::Application

  # Launch config for launching environment instances
  LaunchConfig:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      AssociatePublicIpAddress: false
      ImageId: !Ref LatestAmiId
      InstanceType: t2.micro
      SecurityGroups:
      - Ref: PrivateHttpIngressSecurityGroup
      IamInstanceProfile:
        Ref: InstanceProfile
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          yum -y update
          yum install -y ruby
          cd /home/ec2-user
          curl -O https://aws-codedeploy-${AWS::Region}.s3.amazonaws.com/latest/install
          chmod +x ./install
          ./install auto

  # CodePipeline resources & CloudWatch Events rule to kickoff the pipeline when code changes
  SourceEvent:
    Properties:
      Description: >-
        Rule for Amazon CloudWatch Events to detect changes to the source repository and trigger pipeline execution
      EventPattern:
        detail:
          event:
          - referenceCreated
          - referenceUpdated
          referenceName:
          - main
          referenceType:
          - branch
        detail-type:
        - CodeCommit Repository State Change
        resources:
        - !GetAtt CodeCommitRepo.Arn
        source:
        - aws.codecommit
      Name: !Sub ${EnvironmentName}-SourceEvent
      State: ENABLED
      Targets:
      - Arn: !Sub arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${EnvironmentName}-releasePipeline
        Id: ProjectPipelineTarget
        RoleArn: !GetAtt SourceEventRole.Arn
    Type: AWS::Events::Rule

  # CodePipeline pipeline ;)
  ReleasePipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Name: !Sub ${EnvironmentName}-releasePipeline
      ArtifactStore:
        Location: !Ref ArtifactsBucket
        Type: S3
      RoleArn: !GetAtt CodePipelineTrustRole.Arn
      Stages:
      - Name: Source
        Actions:
        - ActionTypeId:
            Category: Source
            Owner: AWS
            Provider: CodeCommit
            Version: 1
          Configuration:
            BranchName: main
            PollForSourceChanges: false
            RepositoryName: !GetAtt CodeCommitRepo.Name
          InputArtifacts: []
          Name: ApplicationSource
          OutputArtifacts:
          - Name: !Sub ${AWS::StackName}-SourceArtifact
          RunOrder: 1
      - Name: Static_Check
        Actions:
        - ActionTypeId:
            Category: Invoke
            Owner: AWS
            Provider: Lambda
            Version: 1
          Configuration:
            FunctionName: !Ref CFNValidateLambda
            UserParameters: !Sub "{\"input\": \"${AWS::StackName}-SourceArtifact\", \n\"file\": \"cloudformation/application.json\",\n\"output\": \"${ArtifactsBucket}\"}\n"
          InputArtifacts:
          - Name: !Sub ${AWS::StackName}-SourceArtifact
          OutputArtifacts:
          - Name: TemplateSource2
          Name: stack_validate
          Region: !Ref AWS::Region
          RunOrder: 1
      - Name: Build
        Actions:
        - ActionTypeId:
            Category: Build
            Owner: AWS
            Provider: CodeBuild
            Version: 1
          Configuration:
            ProjectName: !Ref AWS::StackName
          InputArtifacts:
          - Name: !Sub ${AWS::StackName}-SourceArtifact
          Name: Build
          OutputArtifacts:
          - Name: !Sub ${AWS::StackName}-BuildArtifact
          RunOrder: 1
      - Name: Test_Stack
        Actions:
        - ActionTypeId:
            Category: Deploy
            Owner: AWS
            Provider: CloudFormation
            Version: 1
          Configuration:
            ActionMode: CHANGE_SET_REPLACE
            Capabilities: CAPABILITY_IAM
            ChangeSetName: test-stack-changeset
            ParameterOverrides: '{"Stage": "Test"}'
            RoleArn: !GetAtt CloudFormationTrustRole.Arn
            StackName: !Sub ${AWS::StackName}-test-stack
            TemplatePath: !Sub ${AWS::StackName}-BuildArtifact::cloudformation/application.json
          InputArtifacts:
          - Name: !Sub ${AWS::StackName}-BuildArtifact
          Name: GenerateChangeSet
          RunOrder: 1
        - ActionTypeId:
            Category: Deploy
            Owner: AWS
            Provider: CloudFormation
            Version: 1
          Configuration:
            ActionMode: CHANGE_SET_EXECUTE
            ChangeSetName: test-stack-changeset
            StackName: !Sub ${AWS::StackName}-test-stack
          InputArtifacts: []
          Name: ExecuteChangeSet
          Namespace: TestStackOutput
          RunOrder: 2
        - ActionTypeId:
            Category: Deploy
            Owner: AWS
            Provider: CodeDeploy
            Version: 1
          Configuration:
            ApplicationName: !Ref AWS::StackName
            DeploymentGroupName: !Sub ${AWS::StackName}-test-stack-DeploymentGroup
          InputArtifacts:
          - Name: !Sub ${AWS::StackName}-BuildArtifact
          Name: Deploy
          OutputArtifacts: []
          RunOrder: 3
      - Name: Service_Status
        Actions:
        - ActionTypeId:
            Category: Invoke
            Owner: AWS
            Provider: Lambda
            Version: 1
          Configuration:
            FunctionName: !Ref servicestatus
            UserParameters: '#{TestStackOutput.Url}'
          Name: Test_Status
          Region: !Ref AWS::Region
          RunOrder: 1
      - Name: Approval
        Actions:
        - ActionTypeId:
            Category: Approval
            Owner: AWS
            Provider: Manual
            Version: 1
          Configuration:
            CustomData: >-
              Do you want to purge Test region resources and initiate Production deployment?
          InputArtifacts: []
          Name: Purge_Test
          OutputArtifacts: []
          Region: !Ref AWS::Region
          RunOrder: 1
        - ActionTypeId:
            Category: Deploy
            Owner: AWS
            Provider: CloudFormation
            Version: 1
          Configuration:
            ActionMode: DELETE_ONLY
            RoleArn: !GetAtt CloudFormationTrustRole.Arn
            StackName: !Sub ${AWS::StackName}-test-stack
          InputArtifacts: []
          Name: Delete_Test_Stack
          OutputArtifacts: []
          Region: !Ref AWS::Region
          RunOrder: 2
      - Name: Prod_Stack
        Actions:
        - ActionTypeId:
            Category: Deploy
            Owner: AWS
            Provider: CloudFormation
            Version: 1
          Configuration:
            ActionMode: CHANGE_SET_REPLACE
            Capabilities: CAPABILITY_IAM
            ChangeSetName: prod-stack-changeset
            ParameterOverrides: '{"Stage": "Prod"}'
            RoleArn: !GetAtt CloudFormationTrustRole.Arn
            StackName: !Sub ${AWS::StackName}-prod-stack
            TemplatePath: !Sub ${AWS::StackName}-BuildArtifact::cloudformation/application.json
          InputArtifacts:
          - Name: !Sub ${AWS::StackName}-BuildArtifact
          Name: GenerateChangeSet
          OutputArtifacts: []
          RunOrder: 1
        - ActionTypeId:
            Category: Deploy
            Owner: AWS
            Provider: CloudFormation
            Version: 1
          Configuration:
            ActionMode: CHANGE_SET_EXECUTE
            ChangeSetName: prod-stack-changeset
            StackName: !Sub ${AWS::StackName}-prod-stack
          InputArtifacts: []
          Name: ExecuteChangeSet
          OutputArtifacts: []
          RunOrder: 2
        - ActionTypeId:
            Category: Deploy
            Owner: AWS
            Provider: CodeDeploy
            Version: 1
          Configuration:
            ApplicationName: !Ref AWS::StackName
            DeploymentGroupName: !Sub ${AWS::StackName}-prod-stack-DeploymentGroup
          InputArtifacts:
          - Name: !Sub ${AWS::StackName}-BuildArtifact
          Name: Deploy
          OutputArtifacts: []
          RunOrder: 3

Outputs:
  # Outputs that are used by the application environment cloudformation template
  vpc:
    Value: !Ref VPC
    Export:
      Name: !Sub ${OutputsPrefix}:VPC
  publicsubnets:
    Value: !Sub ${PublicSubnet1},${PublicSubnet2}
    Export:
      Name: !Sub ${OutputsPrefix}:PublicSubnets
  privatesubnets:
    Value: !Sub ${PrivateSubnet1}
    Export:
      Name: !Sub ${OutputsPrefix}:PrivateSubnets
  publichttpingresssecuritygroup:
    Value: !Ref PublicHttpIngressSecurityGroup
    Export:
      Name: !Sub ${OutputsPrefix}:PublicHttpIngressSecurityGroup
  launchconfig:
    Value: !Ref LaunchConfig
    Export:
      Name: !Sub ${OutputsPrefix}:LaunchConfig
  codedeployapplication:
    Value: !Ref CodeDeployApplication
    Export:
      Name: !Sub ${OutputsPrefix}:CodeDeployApplication
  applicationname:
    Value: !Ref ApplicationName
    Export:
      Name: !Sub ${OutputsPrefix}:ApplicationName
  codedeployrole:
    Value: !GetAtt CodeDeployRole.Arn
    Export:
      Name: !Sub ${OutputsPrefix}:CodeDeployRole