bootstrap.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Bootstraps all s3 buckets and IAM users needed by performance tests pipelines'
Parameters:
  UserName:
    Type: String
    Default: cf-perf-tests-pipeline
  AWSRegion:
    Type: String
    Default: eu-central-1
  BucketName:
    Type: String
    Default: cf-performance-tests
Resources:
  PipelineUser:
    Type: AWS::IAM::User
    Properties:
      UserName: !Ref UserName
  PipelineUserCreds:
    Type: AWS::IAM::AccessKey
    DependsOn: PipelineUser
    Properties:
      Status: Active
      UserName: !Ref UserName
  PipelineUserCredsSecret:
    Type: AWS::SecretsManager::Secret
    DependsOn: PipelineUserCreds
    Properties:
      Name: !Sub /${UserName}
      Description: !Sub 'credentials for the ${UserName} user'
      SecretString: !Sub '{"ACCESS_KEY":"${PipelineUserCreds}","SECRET_KEY":"${PipelineUserCreds.SecretAccessKey}"}'
  PipelineUserPolicy:
    Type: 'AWS::IAM::Policy'
    DependsOn: PipelineUser
    Properties:
      PolicyName: cf-perf-tests-pipeline
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
            - logs:*
            - elasticloadbalancing:*
            - cloudformation:*
            - kms:*
            - ec2:*
            Condition:
              StringEquals:
                aws:RequestedRegion: !Ref AWSRegion
            Resource: '*'
          - Effect: Allow
            Action:
            - iam:*
            - s3:*
            Resource: '*'
      Users:
        - !Ref UserName
  PerfTestBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Ref BucketName
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: DeleteRule
            Status: Enabled
            NoncurrentVersionExpiration:
              NoncurrentDays: 14
Outputs:
  PipelineUserCredsARN:
    Description: ARN for the pipeline user creds that the human running this should retrieve and store in credhub
    Value: !Ref PipelineUserCredsSecret