pipeline.yaml

AWSTemplateFormatVersion: '2010-09-09'
# *** Change this to something useful for you!
Description: github-codepipeline

Parameters:
  # *** This value must always be passed in when creating / updating stack
  # "NoEcho" is set to true, for security, so token won't be visible when examining the resulting stack
  GitHubOAuthToken:
    Type: String
    NoEcho: true
    MinLength: 93
    MaxLength: 93
    AllowedPattern: '[A-Za-z0-9_]*'

  # *** The remaining parameters should either be:
  # - overridden via changing "Default" here (PREFERABLE, since then they're in source control)
  # - or you can pass them in when creating / updating the stack
  
  # *** The owner of the Github repo for this application.
  GitHubOwner:
    Type: String
    Default: symphoniacloud
    AllowedPattern: "[A-Za-z0-9-]+"

  GitHubRepo:
    Type: String
    Default: github-codepipeline
    AllowedPattern: "[A-Za-z0-9-]+"

  GitHubBranch:
    Type: String
    Default: master
    AllowedPattern: "[A-Za-z0-9-]+"

  # *** The stack name for the actual application we're deploying
  ApplicationStackName:
    Type: String
    Default: github-codepipeline-app
    AllowedPattern: "[A-Za-z0-9-]+"

Resources:
  PipelineArtifactsBucket:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled

  CodePipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      ArtifactStore:
        Type: S3
        Location: !Ref PipelineArtifactsBucket
      RestartExecutionOnUpdate: true
      RoleArn: !GetAtt CodePipelineRole.Arn
      Stages:
      - Name: Source
        Actions:
        - Name: Source
          InputArtifacts: []
          ActionTypeId:
            Category: Source
            Owner: ThirdParty
            Version: 1
            Provider: GitHub
          OutputArtifacts:
          - Name: SourceCode
          Configuration:
            Owner: !Ref GitHubOwner
            Repo: !Ref GitHubRepo
            Branch: !Ref GitHubBranch
            PollForSourceChanges: false
            OAuthToken: !Ref GitHubOAuthToken
          RunOrder: 1
      # Build and Deploy, etc., stages would follow. Here is an example
      - Name: Deploy
        Actions:
        - Name: CloudFormationDeploy
          ActionTypeId:
            Category: Deploy
            Owner: AWS
            Provider: CloudFormation
            Version: '1'
          InputArtifacts:
            - Name: SourceCode
          Configuration:
            ActionMode: CREATE_UPDATE
            Capabilities: CAPABILITY_IAM
            RoleArn: !GetAtt CloudformationRole.Arn
            StackName: !Ref ApplicationStackName
            TemplatePath: !Sub "SourceCode::application.yaml"
          RunOrder: 1

  # 'GithubWebhook' satisfies two requirements:
  # -- Means that updates are pushed from GitHub, rather than AWS having to poll
  # -- Means we can filter for required changes
  GithubWebhook:
    Type: 'AWS::CodePipeline::Webhook'
    Properties:
      Authentication: GITHUB_HMAC
      AuthenticationConfiguration:
        SecretToken: !Ref GitHubOAuthToken
      RegisterWithThirdParty: 'true'
      Filters:
      - JsonPath: "$.ref"
        MatchEquals: refs/heads/{Branch}
      TargetPipeline: !Ref CodePipeline
      TargetAction: Source
      TargetPipelineVersion: !GetAtt CodePipeline.Version

  CodePipelineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: Allow
          Principal:
            Service: codepipeline.amazonaws.com
          Action: sts:AssumeRole

  CodePipelineServiceRolePolicy:
    Type: AWS::IAM::Policy
    Properties: 
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
            - iam:PassRole
            Resource: "*"
            Effect: Allow
            Condition:
              StringEqualsIfExists:
                iam:PassedToService:
                - cloudformation.amazonaws.com
                - elasticbeanstalk.amazonaws.com
                - ec2.amazonaws.com
                - ecs-tasks.amazonaws.com
          - Action:
            - codecommit:CancelUploadArchive
            - codecommit:GetBranch
            - codecommit:GetCommit
            - codecommit:GetRepository
            - codecommit:GetUploadArchiveStatus
            - codecommit:UploadArchive
            Resource: "*"
            Effect: Allow
          - Action:
            - codedeploy:CreateDeployment
            - codedeploy:GetApplication
            - codedeploy:GetApplicationRevision
            - codedeploy:GetDeployment
            - codedeploy:GetDeploymentConfig
            - codedeploy:RegisterApplicationRevision
            Resource: "*"
            Effect: Allow
          - Action:
            - codestar-connections:UseConnection
            Resource: "*"
            Effect: Allow
          - Action:
            - elasticbeanstalk:*
            - ec2:*
            - elasticloadbalancing:*
            - autoscaling:*
            - cloudwatch:*
            - s3:*
            - sns:*
            - cloudformation:*
            - rds:*
            - sqs:*
            - ecs:*
            Resource: "*"
            Effect: Allow
          - Action:
            - lambda:InvokeFunction
            - lambda:ListFunctions
            Resource: "*"
            Effect: Allow
          - Action:
            - opsworks:CreateDeployment
            - opsworks:DescribeApps
            - opsworks:DescribeCommands
            - opsworks:DescribeDeployments
            - opsworks:DescribeInstances
            - opsworks:DescribeStacks
            - opsworks:UpdateApp
            - opsworks:UpdateStack
            Resource: "*"
            Effect: Allow
          - Action:
            - cloudformation:CreateStack
            - cloudformation:DeleteStack
            - cloudformation:DescribeStacks
            - cloudformation:UpdateStack
            - cloudformation:CreateChangeSet
            - cloudformation:DeleteChangeSet
            - cloudformation:DescribeChangeSet
            - cloudformation:ExecuteChangeSet
            - cloudformation:SetStackPolicy
            - cloudformation:ValidateTemplate
            Resource: "*"
            Effect: Allow
          - Action:
            - codebuild:BatchGetBuilds
            - codebuild:StartBuild
            - codebuild:BatchGetBuildBatches
            - codebuild:StartBuildBatch
            Resource: "*"
            Effect: Allow
          - Effect: Allow
            Action:
            - devicefarm:ListProjects
            - devicefarm:ListDevicePools
            - devicefarm:GetRun
            - devicefarm:GetUpload
            - devicefarm:CreateUpload
            - devicefarm:ScheduleRun
            Resource: "*"
          - Effect: Allow
            Action:
            - servicecatalog:ListProvisioningArtifacts
            - servicecatalog:CreateProvisioningArtifact
            - servicecatalog:DescribeProvisioningArtifact
            - servicecatalog:DeleteProvisioningArtifact
            - servicecatalog:UpdateProduct
            Resource: "*"
          - Effect: Allow
            Action:
            - cloudformation:ValidateTemplate
            Resource: "*"
          - Effect: Allow
            Action:
            - ecr:DescribeImages
            Resource: "*"
          - Effect: Allow
            Action:
            - states:DescribeExecution
            - states:DescribeStateMachine
            - states:StartExecution
            Resource: "*"
          - Effect: Allow
            Action:
            - appconfig:StartDeployment
            - appconfig:StopDeployment
            - appconfig:GetDeployment
            Resource: "*"
      PolicyName: CodePipelineServiceRolePolicy
      Roles: 
        - !Ref CodePipelineRole


  CloudformationRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: Allow
          Principal:
            Service: cloudformation.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess #TODO: Reduce permissions