main.pipeline.template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description:  >
    This template creates a CI/CD DevSecOps pipeline using Trend Micro Cloud One Solutions to build a more secure proccess automatically.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "[ Customizable Section: General Configuration ]"
        Parameters:
          - emailAddress
      - Label:
          default: "[ Customizable Section: Open Source Security by Snyk ]"
        Parameters:
          - SnykToken
          - RepoName
      - Label:
          default: "[ Customizable Section: Trend Micro Container Security ]"
        Parameters:
          - SmartCheckURL
          - SmartCheckAuthorization
          - ECRRegistry
          - ECRRepoName 
          - Imagetag
          - ImageDigest
          - AWSRegion
          - AWSAccessKeyID
          - AWSSecretAccessKey
          - insecureSkipVerify
      - Label:
          default: "[ Customizable Section: Deploy To ECS]"
        Parameters:
          - Cluster
          - Service

Parameters:

  SnykToken:
    Type: String
    Description: Your Snyk Token to be used in the Snyk CLI Continuos Integration.

  RepoName:
    Type: String
    Description: The name of your repository.

  SmartCheckURL:
    Type: String
    Description: The Smart Check URL

  SmartCheckAuthorization:
    Type: String
    Description: The Smart Check Authorization Token

  ECRRegistry:
    Type: String
    Description: The URL for your ECR Registry

  ECRRepoName:
    Type: String
    Description: The name of your ECR Repository 

  Imagetag:
    Type: String
    Description: Your Image tag

  ImageDigest:
    Type: String
    Description: Your Image Digest

  AWSRegion:
    Type: String
    Description: Your AWS Region

  AWSAccessKeyID:
    Type: String
    Description: Your AWS AccessKeyID

  AWSSecretAccessKey:
    Type: String
    Description: Your AWS SecretAccessKey

  insecureSkipVerify:
    Type: String
    Description: The Smart Check insecureSkipVerify. true or false

  emailAddress:
    Type: String
    Description: The email Address that you want to receive the Manual Approve Notification

  Cluster:
    Type: String
    Description: The name of your ECS Cluster
  
  Service:
    Type: String
    Description: The name of your Service in the ECS Cluster

Resources:

  #SSM Parameter to store the Snyk Token
  SnykTokenParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: snykAuthToken
      Type: String
      Description: Parameter to store the Snyk Token
      Tier: Standard
      Value: !Sub "${SnykToken}"

  #SSM Parameter to store the Smart Check URL
  SmartCheckURLParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: SmartCheckAPIURL
      Type: String
      Description: Parameter to store the Smart Check URL
      Tier: Standard
      Value: !Sub "${SmartCheckURL}"

  #SSM Parameter to store the Smart Check Authorization
  SmartCheckAuthorizationParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: SmartCheckAuthorization
      Type: String
      Description: Parameter to store the Smart Check Authorization
      Tier: Standard
      Value: !Sub "${SmartCheckAuthorization}"

  #SSM Parameter to store the Registry URL
  ECRRegistryParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: registryDemoPipeline
      Type: String
      Description: Parameter to store the ECR Registry Name for the Trend Demo Pipeline
      Tier: Standard
      Value: !Sub "${ECRRegistry}"

  #SSM Parameter to store the Repository Name
  RepositoryNameParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: repositoryDemoPipeline
      Type: String
      Description: Parameter to store the ECR Repository Name for the Trend Demo Pipeline
      Tier: Standard
      Value: !Sub "${ECRRepoName}"

  #SSM Parameter to store the Image tag
  ImagetagParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: ImagetagDemoPipeline
      Type: String
      Description: Parameter to store the Image tag
      Tier: Standard
      Value: !Sub "${Imagetag}"

  #SSM Parameter to store the Image Digest
  ImageDigestParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: ImageDigestDemoPipeline
      Type: String
      Description: Parameter to store the Image Digest DemoPipeline
      Tier: Standard
      Value: !Sub "${ImageDigest}"

  #SSM Parameter to store the AWS Region
  awsRegionParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: RegionAWS
      Type: String
      Description: Parameter to store the AWS Region
      Tier: Standard
      Value: !Sub "${AWSRegion}"

  #SSM Parameter to store the AWS AccessKeyID
  awsAccessKeyIDParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: AccessKeyIDAWS
      Type: String
      Description: Parameter to store the AWS AccessKeyID
      Tier: Standard
      Value: !Sub "${AWSAccessKeyID}"

  #SSM Parameter to store the AWS SecretAccessKey
  awsSecretAccessKeyParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: SecretAccessKeyAWS
      Type: String
      Description: Parameter to store the AWS SecretAccessKey
      Tier: Standard
      Value: !Sub "${AWSSecretAccessKey}"

  #SSM Parameter to store the insecureSkipVerify
  insecureSkipVerifyParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: insecureSkipVerify
      Type: String
      Description: Parameter to store the insecureSkipVerify Smart Check
      Tier: Standard
      Value: !Sub "${insecureSkipVerify}"

  BucketToStoreArtifacts:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join
      - "-"
      - - "bucket-to-store-artifacts-pipeline-workshop"
        - !Select
          - 0
          - !Split
            - "-"
            - !Select
              - 2
              - !Split
                - "/"
                - !Ref "AWS::StackId"

  # SNS Topic for Manual Approve
  SNSTopicManualApprove:
    Type: AWS::SNS::Topic
    Properties:
      FifoTopic: false
      Subscription: 
      - Endpoint: !Sub ${emailAddress}
        Protocol: email
      TopicName: TrendMicroWorkshopPipelineManualApprove
      Tags:
        - Key: pipeline-name
          Value: TrendMicro-SecurePipelineWorkshop

  MySecurePipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      #ArtifactStore: !Ref ArtifactStore2
      Name: TrendMicro-SecurePipelineWorkshop
      RestartExecutionOnUpdate: true
      RoleArn: !GetAtt PipelineRole.Arn
      Stages:
        - Name: Source
          Actions:
            - Name: SourceAction
              ActionTypeId:
                Category: Source # Valid categories "Source", "Build", "Test", "Deploy", "Invoke", and "Approval"
                Owner: AWS  # 3 valid values - AWS, Thirdparty, and custom
                Version: '1'
                Provider: CodeCommit # Depends on the Action Category, various Action Provider options are available. Refer to codepipeline CF template documentation.
              OutputArtifacts:
                - Name: SourceOutput
              Configuration: # for each action provider, the configuration parameters differ. Refer to codepipeline structure reference documentation. https://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.html#structure-configuration-examples
                BranchName: master
                RepositoryName: !Sub ${RepoName}
                PollForSourceChanges: false
              RunOrder: 1

        ## Build the project and use SnykCLI to Scan the code Hosted in CodeCommit
        - Name: Scan-The-Code-With-Snyk-CLI
          Actions:
            - Name: Snyk-Scan
              InputArtifacts:
                - Name: SourceOutput
              ActionTypeId:
                Category: Test
                Owner: AWS
                Version: '1'
                Provider: CodeBuild
              OutputArtifacts:
                - Name: SnykResult
              Configuration:
                ProjectName: !Ref CodeBuildSnykScan
              RunOrder: 2


        ## Manual Aprove
        - Name: ManualApprove
          Actions:
            - Name: CodeVulnerabilityResultManualApprove
              ActionTypeId:
                Category: Approval
                Owner: AWS
                Version: '1'
                Provider: Manual
              Configuration:
                NotificationArn: !Ref SNSTopicManualApprove
                CustomData: "Verifique o número de Vulnerabilidades."
                ExternalEntityLink: !Sub https://console.aws.amazon.com/codesuite/codepipeline/pipelines/TrendMicro-SecurePipelineWorkshop/view?region=${AWS::Region}
              RunOrder: 3 

        ## Build, deploy to ECR and Scan the Container Image using Trend Micro Smart Check 
        - Name: Scan-And-Build-The-Container-Image
          Actions:
            - Name: Container-Scan
              InputArtifacts:
                - Name: SourceOutput
              ActionTypeId:
                Category: Test
                Owner: AWS
                Version: '1'
                Provider: CodeBuild
              OutputArtifacts:
                - Name: ScanAndImageBuildResult
              Configuration:
                ProjectName: !Ref ContainerImageScan
              RunOrder: 4

        ## Manual Aprove 2 - Before Deploy to Fargate
        - Name: SecondManualApprove
          Actions:
            - Name: ContainerVulnerabilityResultManualApprove
              ActionTypeId:
                Category: Approval
                Owner: AWS
                Version: '1'
                Provider: Manual
              Configuration:
                NotificationArn: !Ref SNSTopicManualApprove
                CustomData: "Verifique o número de Vulnerabilidades."
                ExternalEntityLink: !Sub https://console.aws.amazon.com/codesuite/codepipeline/pipelines/TrendMicro-SecurePipelineWorkshop/view?region=${AWS::Region}
              RunOrder: 5


        ## Deploy image to Fargate  
        - Name: Deployment
          Actions:
            - Name: Deploy-to-Fargate
              InputArtifacts:
                - Name: SourceOutput
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: '1'
                Provider: ECS
              Configuration:
                ClusterName: !Ref Cluster
                ServiceName: !Ref Service
                FileName: imagedefinitions.json
              RunOrder: 6

      ArtifactStore: 
        Type: S3 
        Location:
          Ref: BucketToStoreArtifacts 

  ### CodeBuild to build and test for Vulnerabilities the Repo
  CodeBuildSnykScan:
    Type: AWS::CodeBuild::Project
    Properties: 
      Description: Build Project to Scan for Vulnerabilities in the Dependencies using Synk CLI
      Artifacts: 
        Type: NO_ARTIFACTS
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:4.0
        Type: LINUX_CONTAINER
        PrivilegedMode: false
      ServiceRole: !Ref CodeBuildSnykScanRole
      Source:
        Type: CODECOMMIT
        Location: !Sub https://git-codecommit.us-east-1.amazonaws.com/v1/repos/${RepoName}
        BuildSpec: buildspec-snyk-scan.yml
      LogsConfig:
          CloudWatchLogs:
            GroupName: TrendMicro-SecurePipelineWorkshop-logs
            Status: ENABLED
            StreamName: SnykScan
      QueuedTimeoutInMinutes: 10
      Tags:
        - Key: pipeline-name
          Value: TrendMicro-SecurePipelineWorkshop 


  ### Build, deploy to ECR and Scan the Container Image using Trend Micro Smart Check
  ContainerImageScan:
    Type: AWS::CodeBuild::Project
    Properties: 
      Description: Build the container, push to ECR and Scan the Image using Trend Micro Smart Check
      Artifacts: 
        Type: NO_ARTIFACTS
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:4.0
        Type: LINUX_CONTAINER
        PrivilegedMode: true
      ServiceRole: !Ref CodeBuildSnykScanRole
      Source:
        Type: CODECOMMIT
        Location: !Sub https://git-codecommit.us-east-1.amazonaws.com/v1/repos/${RepoName}
        BuildSpec: buildspec-container-scan-build.yml
      LogsConfig:
          CloudWatchLogs:
            GroupName: TrendMicro-SecurePipelineWorkshop-logs-SCScan
            Status: ENABLED
            StreamName: SmartCheckBuildDemo
      QueuedTimeoutInMinutes: 10
      Tags:
        - Key: pipeline-name
          Value: TrendMicro-SecurePipelineWorkshop 


  ### Role used by The Pipeline
  PipelineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: codepipeline.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: trend-micro-pipeline-workshop
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: '*'
                Resource: '*'

    ### CodeBuildSnykScan Role
  CodeBuildSnykScanRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: codebuild.amazonaws.com
      Policies:
        - PolicyName: SecurityCodeAnalysisPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: iam:PassRole
                Resource: '*'
              - Effect: Allow
                Action:
                  - iam:PassRole
                  - logs:*
                  - s3:*
                  - cloudformation:*
                  - cloudwatch:*
                  - codebuild:*
                  - codecommit:*
                  - codepipeline:*
                  - ssm:*
                  - lambda:*
                  - ecr:*
                    #- cloudtrail:*
                    #- kms:*
                Resource: '*'

Outputs:

  S3BucketName:
    Description: URL of the Bucket where the artifacts of the Pipeline is
    Value:  !Sub https://s3.console.aws.amazon.com/s3/buckets/${BucketToStoreArtifacts}?region=${AWS::Region}

  SecurePipeline:
    Description: URL of the Pipeline
    Value: !Sub https://console.aws.amazon.com/codesuite/codepipeline/pipelines/${MySecurePipeline}/view?region=${AWS::Region}