service2.stack.yml

AWSTemplateFormatVersion: 2010-09-09
Description: Service1 bootstrap pipeline.  Update Iac, build docker images, deploy service, etc...

Parameters:
  GitHubOwner:
    Description: The name of the GitHub repository owner
    Type: String
    Default: 'thestackshack'
  GitHubToken:
    Type: String
    Description: GitHub repository OAuth token
    NoEcho: true
  GitHubRepo:
    Type: String
    Description: GitHub repository name
    Default: 'service1-stack-cicd'

  Environment:
    Type: String
    Description: Environment name

  VPCStack:
    Type: String
    Description: VPC Stack Name

  ECSStack:
    Type: String
    Description: ECS Stack Name

  NotificationsStack:
    Type: String
    Description: Notifications Stack Name

  AppName:
    Type: String
    Description: Application name

  ServiceName:
    Type: String
    Description: Service name.  Lowercase
    Default: 'service2'

Mappings:
  Branch:
    prod:
      BRANCH: 'master'
    sandbox:
      BRANCH: 'develop'

Resources:

  #
  # Bucket used by the pipelines to store artifacts.
  #
  PipelinesBucket:
    Description: The artifact bucket required for inter-stage data exchange
    Type: AWS::S3::Bucket

  #
  # IAM Role needed by the pipelines
  #
  CodePipelineRole:
    Description: The role CodePipeline will assume during pipeline execution
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
            Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
            Action: sts:AssumeRole

  CodePipelinePolicy:
    Description: Policy for the CodePipeline Role
    DependsOn: CodePipelineRole
    Type: AWS::IAM::Policy
    Properties:
      PolicyName:
        Fn::Join:
          - ''
          - - Ref: AWS::StackName
            - '-pipeline-policy'
      Roles:
        - !Ref CodePipelineRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
              - s3:*
            Effect: Allow
            Resource:
              - !GetAtt PipelinesBucket.Arn
              - !Join ["", [!GetAtt PipelinesBucket.Arn, "*"]]
          - Action:
              - cloudformation:*
            Effect: Allow
            Resource:
              - !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/*
          - Action:
              - codepipeline:*
            Effect: Allow
            Resource:
              - !Sub arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:*
          - Action:
              - codebuild:StartBuild
              - codebuild:BatchGetBuilds
              - codebuild:StopBuild
            Effect: Allow
            Resource:
              - '*'
          - Action:
              - iam:PassRole
            Effect: Allow
            Resource:
              - !GetAtt CloudFormationRole.Arn

  #
  # IAM Role needed by cloudformation
  #
  CloudFormationRole:
    Description: The role cloudformation will assume during pipeline execution
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
            Effect: Allow
            Principal:
              Service:
                - cloudformation.amazonaws.com
            Action: sts:AssumeRole
  CloudFormationPolicy:
    Description: Policy for the cloudformation execution Role
    DependsOn: CloudFormationRole
    Type: AWS::IAM::Policy
    Properties:
      PolicyName:
        Fn::Join:
          - ''
          - - Ref: AWS::StackName
            - '-cloudformation-policy'
      Roles:
        - !Ref CloudFormationRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - '*'
            Resource:
              - '*'

  #
  # CodeBuild Permissions
  #
  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - codebuild.amazonaws.com

  CodeBuildRolePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: CodeBuildRolePolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource: '*'
          - Effect: Allow
            Action:
              - s3:*
            Resource:
              - !Sub 'arn:aws:s3:::${PipelinesBucket}'
              - !Sub 'arn:aws:s3:::${PipelinesBucket}/*'
          - Effect: Allow
            Action:
              - ecr:GetAuthorizationToken
            Resource: '*'
          - Effect: Allow
            Action:
              - ecr:GetDownloadUrlForLayer
              - ecr:BatchGetImage
              - ecr:BatchCheckLayerAvailability
              - ecr:PutImage
              - ecr:InitiateLayerUpload
              - ecr:UploadLayerPart
              - ecr:CompleteLayerUpload
            Resource: !Sub "arn:aws:ecr:${AWS::Region}:${AWS::AccountId}:repository/${AppName}/${ServiceName}/${Environment}"
          - Effect: Allow
            Action:
              - sns:Publish
            Resource: !Sub 'arn:aws:sns:${AWS::Region}:${AWS::AccountId}:*'
      Roles:
        - !Ref CodeBuildRole

  #
  # CodeBuild
  #
  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    DependsOn: CodeBuildRolePolicy
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/docker:1.12.1
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: AWS_DEFAULT_REGION
            Value: !Ref AWS::Region
          - Name: REPOSITORY_URI
            Value: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${AppName}/${ServiceName}/${Environment}"
          - Name: APP
            Value: !Sub "${AppName}-${ServiceName}-${Environment}"
          - Name: SNS_TOPIC_ARN
            Value:
              Fn::ImportValue:
                !Sub "${NotificationsStack}-EventTopic"
      Name: !Sub "${AWS::StackName}-code-build"
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Source:
        Type: CODEPIPELINE
        BuildSpec: buildspec.yml
      TimeoutInMinutes: 10 # must be between 5 minutes and 8 hours


  #
  # CloudWatch Event for build notifications.
  #
  BuildEventRule:
    Type: 'AWS::Events::Rule'
    Properties:
      Description: 'BuildEventRule'
      EventPattern:
        source:
          - 'aws.codebuild'
        detail-type:
          - 'CodeBuild Build State Change'
        detail:
          project-name:
            - !Sub "${AWS::StackName}-code-build"
          build-status:
            - 'IN_PROGRESS'
            - 'SUCCEEDED'
            - 'FAILED'
            - 'STOPPED'
      State: 'ENABLED'
      Targets:
        -
          Arn:
            Fn::ImportValue:
              !Sub "${NotificationsStack}-EventTopic"
          Id: 'service-build-notifications'

  #
  # Pipelines that create/update the cloudformation stacks within the project
  #
  Pipeline:
    Description: The pipeline that will generate other stacks
    Type: AWS::CodePipeline::Pipeline
    DependsOn:
      - CodePipelinePolicy
      - CloudFormationPolicy
    Properties:
      RestartExecutionOnUpdate: True
      RoleArn: !GetAtt CodePipelineRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref PipelinesBucket
      Stages:
        - Name: Source
          Actions:
            - Name: CloneRepository
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: 1
                Provider: GitHub
              OutputArtifacts:
                - Name: GitSource
              Configuration:
                Owner: !Ref GitHubOwner
                Branch: !FindInMap [Branch, !Ref 'Environment', BRANCH]
                Repo: !Ref GitHubRepo
                OAuthToken: !Ref GitHubToken
              RunOrder: 1
        - Name: Build
          Actions:
            - Name: ECR
              InputArtifacts:
                - Name: GitSource
              OutputArtifacts:
                - Name: ECRSource
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                TemplatePath: "GitSource::stacks/ecr.stack.yml"
                ActionMode: CREATE_UPDATE
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt CloudFormationRole.Arn
                StackName:
                  Fn::Join:
                    - ''
                    - - Ref: AppName
                      - '-'
                      - Ref: ServiceName
                      - '-ecr-'
                      - Ref: Environment
                ParameterOverrides: !Sub |
                  {
                    "RepositoryName": "${AppName}/${ServiceName}/${Environment}"
                  }
              RunOrder: 1
            - Name: BuildPushImage
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              Configuration:
                ProjectName: !Ref CodeBuildProject
              InputArtifacts:
                - Name: GitSource
              OutputArtifacts:
                - Name: BuildOutput
              RunOrder: 2
        - Name: Service
          Actions:
            - Name: Infrastructure
              InputArtifacts:
                - Name: GitSource
                - Name: BuildOutput
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                TemplatePath: "GitSource::stacks/service.stack.yml"
                ActionMode: CREATE_UPDATE
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt CloudFormationRole.Arn
                StackName:
                  Fn::Join:
                    - ''
                    - - Ref: AppName
                      - '-'
                      - Ref: ServiceName
                      - '-service-'
                      - Ref: Environment
                ParameterOverrides: !Sub
                  - |
                    {
                      "BuildVersion" : { "Fn::GetParam" : ["BuildOutput", "version.json", "version"]},
                      "VPCStack" : "${VPCStack}",
                      "ECSStack" : "${ECSStack}",
                      "RepositoryUrl": "${RepositoryUrl}",
                      "Environment" : "${Environment}",
                      "Path": "service2",
                      "ListenerRulePriority": "3"
                    }
                  - {
                      VPCStack: { "Ref" : "VPCStack"},
                      ECSStack: { "Ref" : "ECSStack"},
                      RepositoryUrl: { "Fn::Sub" : [ "${AccountId}.dkr.ecr.${Region}.amazonaws.com/${AppName}/${ServiceName}/${Environment}", { AccountId: {"Ref" : "AWS::AccountId"}, Region: {"Ref" : "AWS::Region"}, ServiceName: {"Ref" : "ServiceName"}, Environment: {"Ref" : "Environment"} } ] },
                      Environment: { "Ref" : "Environment"}
                    }
              RunOrder: 1