pipeline.cfn.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: |
  Pipeline for Plex Infrastructure Deployment
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: Pipeline Configuration
      Parameters: [Name, UserName, GitHubOAuthToken]
    ParameterLabels:
      Name:
        default: Name of Pipeline and future stack prefixes
      UserName:
        default: User to create in IAM
Parameters:
  Name:
    Type: String
    AllowedPattern: "[-a-z0-9]+"
    ConstraintDescription: "lower case letters, numbers, and dashes only"
  UserName:
    Type: String
    AllowedPattern: "[-a-z0-9]+"
    ConstraintDescription: "lower case letters, numbers, and dashes only"
  BuildComputeType:
    Type: String
    Default: BUILD_GENERAL1_SMALL
    AllowedValues: [BUILD_GENERAL1_SMALL, BUILD_GENERAL1_MEDIUM, BUILD_GENERAL1_LARGE]
  BuildImage:
    Type: String
    Default: aws/codebuild/python:2.7.12
    AllowedPattern: "[-A-Za-z0-9/._]+:[-A-Za-z0-9/._]+"
  GitHubOwner:
    Description: GitHub account username.
    Type: String
    Default: lordmuffin
  GitHubRepo:
    Description: GitHub repo name.
    Type: String
    Default: aws-cfn-plex
  GitHubBranch:
    Description: The branch that will trigger build/deploy.
    Type: String
    Default: master
  VersionDownload:
    Description: Version Zip to download.
    Type: String
    Default: "1.1"
Resources:
  ArtifactBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${Name}-artifacts
      VersioningConfiguration:
        Status: Enabled
  CodeBuildServiceRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "codebuild.us-east-1.amazonaws.com"
                - "codebuild.us-west-2.amazonaws.com"
                - "codebuild.eu-west-1.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"

  CodeBuildServiceRolePolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: "CodeBuildPolicy"
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Sid: CloudWatchLogsPolicy
          Effect: Allow
          Action:
          - logs:CreateLogGroup
          - logs:CreateLogStream
          - logs:PutLogEvents
          Resource:
          - "*"
        - Sid: CodeCommitPolicy
          Effect: Allow
          Action:
          - codecommit:GitPull
          Resource:
          - "*"
        - Sid: S3GetObjectPolicy
          Effect: Allow
          Action:
          - s3:GetObject
          - s3:GetObjectVersion
          Resource:
          - "*"
        - Sid: S3PutObjectPolicy
          Effect: Allow
          Action:
          - s3:PutObject
          Resource:
          - "*"
        - Sid: FullAdminAccess
          Effect: Allow
          Action: "*"
          Resource: "*"
        - Action:
          - dynamodb:GetItem
          - dynamodb:Query
          - dynamodb:Scan
          - dynamodb:PutItem
          Effect: Allow
          Resource: "*"
      Roles:
        - !Ref CodeBuildServiceRole

  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub "${Name}-build"
      Description: !Sub ${Name} CodeBuild Project
      ServiceRole: !GetAtt CodeBuildServiceRole.Arn
      Artifacts:
        Type: no_artifacts
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: !Ref BuildComputeType
        Image: aws/codebuild/python:2.7.12
        EnvironmentVariables:
          - Name: BUCKET
            Value: !Ref ArtifactBucket
      Source:
        Type: S3
        Location: ${!Ref ArtifactBucket}, "/", ${!Ref GitHubRepo}, ".zip"
      TimeoutInMinutes: 480

  CodePipelineServiceRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "codepipeline.amazonaws.com"
                - "cloudformation.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"

  CodePipelineServiceRolePolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: "CodePipelinePolicy"
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
            - s3:GetObject
            - s3:GetObjectVersion
            - s3:GetBucketVersioning
            Resource: "*"
            Effect: Allow
          - Action:
            - s3:PutObject
            Resource:
            - arn:aws:s3:::codepipeline*
            - arn:aws:s3:::elasticbeanstalk*
            Effect: Allow
          - Action:
            - codecommit:CancelUploadArchive
            - codecommit:GetBranch
            - codecommit:GetCommit
            - codecommit:GetUploadArchiveStatus
            - codecommit:UploadArchive
            Resource: "*"
            Effect: Allow
          - Action:
            - elasticbeanstalk:*
            - ec2:*
            - elasticloadbalancing:*
            - autoscaling:*
            - cloudwatch:*
            - s3:*
            - sns:*
            - cloudformation:*
            - rds:*
            - sqs:*
            - ecs:*
            - ssm:*
            - ds:*
            - kms:*
            - iam:*
            - lambda:*
            Resource: "*"
            Effect: Allow
          - Action:
              - codebuild:BatchGetBuilds
              - codebuild:StartBuild
            Resource: "*"
            Effect: Allow
          - Action:
              - dynamodb:CreateTable
              - dynamodb:DescribeTable
              - dynamodb:ListTables
            Resource: "*"
            Effect: Allow
      Roles:
        - !Ref CodePipelineServiceRole

  CodePipeline:
    Type: "AWS::CodePipeline::Pipeline"
    Properties:
      Name: !Sub "${Name}-pipeline"
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      Stages:
        - Name: Source
          Actions:
            - Name: SourceAction
              ActionTypeId:
                Category: Source
                Owner: AWS
                Version: 1
                Provider: S3
              OutputArtifacts:
                - Name: SourceOutput
              Configuration:
                S3Bucket: !Ref ArtifactBucket
                S3ObjectKey: !Sub ${VersionDownload}.zip
        - Name: Build
          Actions:
            - Name: Build
              InputArtifacts:
                - Name: SourceOutput
              OutputArtifacts:
                - Name: BuildOutput
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref CodeBuildProject
              RunOrder: 1
        - Name: Deploy
          Actions:
            - Name: CreateChangeset
              InputArtifacts:
                - Name: BuildOutput
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                StackName: !Sub ${Name}
                ActionMode: CHANGE_SET_REPLACE
                Capabilities: CAPABILITY_IAM
                ChangeSetName: !Sub ${Name}-changeset
                TemplatePath: BuildOutput::templates/master.cfn.yml
                TemplateConfiguration: BuildOutput::config/config.json
                RoleArn: !GetAtt CodePipelineServiceRole.Arn
                ParameterOverrides: !Sub |
                  {
                    "S3TemplateBucket" : "${ArtifactBucket}"
                  }
              RunOrder: 1
            - Name: ExecuteChangeset
              InputArtifacts:
                - Name: BuildOutput
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                StackName: !Sub ${Name}
                ActionMode: CHANGE_SET_EXECUTE
                ChangeSetName: !Sub ${Name}-changeset
              RunOrder: 2
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactBucket
  UserCreation:
    Type: "AWS::IAM::User"
    Properties:
      UserName: !Ref UserName
      Policies:
        - PolicyName: AWSCodeCommitPowerUser
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - codecommit:BatchGetRepositories
              - codecommit:CreateBranch
              - codecommit:CreateRepository
              - codecommit:Get*
              - codecommit:GitPull
              - codecommit:GitPush
              - codecommit:List*
              - codecommit:Put*
              - codecommit:Test*
              - codecommit:Update*
              Resource: "*"
  GitHubPullResourceRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: GitHubPullResourcePolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - S3:PutObject
                  - S3:PutObjectAcl
                Resource: "*"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
  GitHubPullResourceFunction:
    Type: "AWS::Lambda::Function"
    DependsOn: GitHubPullResourceRole
    Properties:
      FunctionName: GitHubPullResourceFunction
      Code:
        ZipFile: |
          # Written by: Andrew Jackson
          # This is used to pull repo from github and drop to S3
          import urllib2
          import boto3
          import sys
          import json
          import cfnresponse
          s3 = boto3.resource('s3')

          def lambda_handler(event, context):
              print "event.dump = " + json.dumps(event)
              responseData = {}
              # If not valid cloudformation custom resource call
              try:
                  response = urllib2.urlopen (event["ResourceProperties"]["git_url"].encode('utf-8'))
                  zipcontent = response.read()
                  s3.Bucket(event["ResourceProperties"]["bucket_name"]).put_object(Key=event["ResourceProperties"]["key"], Body=zipcontent)
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, ".zip pulled to S3 Bucket!")
              except Exception:
                  cfnresponse.send(event, context, cfnresponse.FAILED, responseData, "Bucket Name and Key are all required.")
                  print "ERROR"
      Description: Clone GitHub Repository to S3
      Handler: index.lambda_handler
      MemorySize: 128
      Role: !GetAtt GitHubPullResourceRole.Arn
      Runtime: python2.7
      Timeout: 5
  GitHubPull:
    Type: Custom::GitHubPullResourceFunction
    DependsOn: GitHubPullResourceFunction
    Properties:
      ServiceToken: !GetAtt GitHubPullResourceFunction.Arn
      bucket_name: !Ref ArtifactBucket
      git_url: !Join ["", ["https://github.com/", !Ref GitHubOwner, "/", !Ref GitHubRepo, "/raw/master/v", !Ref VersionDownload, ".zip"]]
      key: !Sub ${VersionDownload}.zip
Outputs:
  GitHubRepo:
    Value: !Ref GitHubRepo
  CodePipeline:
    Value: !Ref CodePipeline
  CodeBuildProject:
    Value: !Ref CodeBuildProject
  ArtifactBucket:
    Value: !Ref ArtifactBucket