main.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: "Create a CodePipeline for deploying a CloudFormation StackSet - (v1.0.0)"
Parameters:
  # General Configuration
  SuggestedStackName:
    Type: "String"
    Description: "This is the suggested name for this stack.  If using the console, you can copy and paste this into the stack name field."
    Default: "main-boilerplate-cloudformation-stacksets"
  InfrastructureName:
    Type: "String"
    Description: "A name used to differentiate this infrastructure from other existing infrastructure."
    Default: "main"
  StackSetNameSuffix:
    Type: "String"
    Description: "The suffix of the StackSet name."
  # CodePipeline Configuration
  CloudFormationCapabilities:
    Type: "String"
    Description: "A list of the capabilities that CloudFormation should have when executing stacks via CodePipeline."
    Default: "CAPABILITY_NAMED_IAM,CAPABILITY_AUTO_EXPAND"
  AppBaseFolder:
    Type: "String"
    Description: "The base repository folder for the application."
    Default: "v1"
  ActionMode:
    Type: "String"
    Description: "The CodePipeline CloudFormation stack action mode."
    AllowedValues:
    - "CHANGE_SET_EXECUTE"
    - "CHANGE_SET_REPLACE"
    - "CREATE_UPDATE"
    - "DELETE_ONLY"
    - "REPLACE_ON_FAILURE"
    Default: "REPLACE_ON_FAILURE"
  VersionFile:
    Type: "String"
    Description: "The name of the JSON file that contains the version number (needs to be a flat JSON file)."
    Default: "version.json"
  # Source Configuration
  CodePipelineGitHubOrganization:
    Type: "String"
    Description: "What GitHub user/organization is the project repository a member of?"
  CodePipelineSourceRepository:
    Type: "String"
    Description: "What is the name of the GitHub repository for this project? (e.g. boilerplate-cloudformation-stacksets)"
  CodePipelineSourceBranch:
    Type: "String"
    Description: "What is the branch name of the GitHub repository?"
    Default: "main"
  # Deployment Configuration
  BasePath:
    Type: "String"
    Description: "The base base that should be added for the extracted files."
    Default: ""
  DeploymentBucketName:
    Type: "String"
    Description: "The name of the bucket that the content files should be deployed to."
  CacheControl:
    Type: "String"
    Description: "The Cache-Control header value applied to all extracted files."
    Default: "max-age=60, public"
  ExtractFiles:
    Type: "String"
    Description: "Should the files from the content ZIP be extracted to S3?"
    AllowedValues:
    - "Yes"
    - "No"
    Default: "Yes"
  DeploymentTemplate:
    Type: "String"
    Description: "The name of the template that should be used as the template to deploy."
    Default: "sns/topic.yaml"
Conditions:
  AppBaseFolder: !Not [ !Equals [ !Ref AppBaseFolder, "" ] ]
  BasePath: !Not [ !Equals [ !Ref BasePath, "" ] ]
  CacheControl: !Not [ !Equals [ !Ref CacheControl, "" ] ]
  ExtractFiles: !Equals [ !Ref ExtractFiles, "Yes" ]
Resources:
  DeployCodePipelineRole:
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: "Allow"
          Principal:
            Service:
            - "cloudformation.amazonaws.com"
            - "codepipeline.amazonaws.com"
          Action:
          - "sts:AssumeRole"
      Policies:
      - PolicyName: "SetupServiceRole"
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Effect: "Allow"
            Action:
            - "iam:AttachRolePolicy"
            - "iam:CreateRole"
            - "iam:CreateServiceLinkedRole"
            - "iam:DeleteRole"
            - "iam:DeleteRolePermissionsBoundary"
            - "iam:DeleteRolePolicy"
            - "iam:DeleteServiceLinkedRole"
            - "iam:DetachRolePolicy"
            - "iam:GetRole"
            - "iam:GetRolePolicy"
            - "iam:GetServiceLinkedRoleDeletionStatus"
            - "iam:ListAttachedRolePolicies"
            - "iam:ListInstanceProfilesForRole"
            - "iam:ListRolePolicies"
            - "iam:ListRoleTags"
            - "iam:PassRole"
            - "iam:PutRolePermissionsBoundary"
            - "iam:PutRolePolicy"
            - "iam:TagRole"
            - "iam:UntagRole"
            - "iam:UpdateAssumeRolePolicy"
            - "iam:UpdateRole"
            - "iam:UpdateRoleDescription"
            Resource: "*"
          - Effect: "Allow"
            Action:
            - "kms:GenerateDataKey"
            - "kms:Decrypt"
            Resource: !Sub "{{resolve:ssm:/kms/${InfrastructureName}/key/s3/arn}}"
          - Effect: "Allow"
            Action:
            - "ssm:AddTagsToResource"
            - "ssm:DeleteParameter"
            - "ssm:DeleteParameters"
            - "ssm:DescribeDocumentParameters"
            - "ssm:DescribeParameters"
            - "ssm:GetParameter"
            - "ssm:GetParameterHistory"
            - "ssm:GetParameters"
            - "ssm:GetParametersByPath"
            - "ssm:LabelParameterVersion"
            - "ssm:ListTagsForResource"
            - "ssm:PutParameter"
            - "ssm:RemoveTagsFromResource"
            Resource: "*"
      ManagedPolicyArns:
      - "arn:aws:iam::aws:policy/AWSCloudFormationFullAccess"
      - "arn:aws:iam::aws:policy/AWSCodePipeline_FullAccess"
      - "arn:aws:iam::aws:policy/AmazonS3FullAccess"
      - "arn:aws:iam::aws:policy/AmazonSNSFullAccess"
      - "arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess"
      Tags:
      - Key: "Name"
        Value: !Ref "AWS::StackName"
      - Key: "application"
        Value: !Ref "AWS::StackName"
      - Key: "contact-email"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/contact-email}}"
      - Key: "customer"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/customer}}"
      - Key: "environment"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/environment}}"
      - Key: "team"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/team}}"
  DeployCodePipeline:
    Type: "AWS::CodePipeline::Pipeline"
    Properties:
      RoleArn: !GetAtt DeployCodePipelineRole.Arn
      Name: !Sub "${InfrastructureName}-${StackSetNameSuffix}"
      RestartExecutionOnUpdate: true
      ArtifactStores:
      - Region: !Ref "AWS::Region"
        ArtifactStore:
          Type: "S3"
          Location: !Sub "{{resolve:ssm:/s3/${InfrastructureName}/bucket/codepipeline/name}}"
      Stages:
      - Name: "Source"
        Actions:
        - Name: "GitHub_Source"
          Namespace: "Source"
          ActionTypeId:
            Category: "Source"
            Owner: "ThirdParty"
            Provider: "GitHub"
            Version: "1"
          Configuration:
            Owner: !Ref CodePipelineGitHubOrganization
            Repo: !Ref CodePipelineSourceRepository
            Branch: !Ref CodePipelineSourceBranch
            OAuthToken: !Sub "{{resolve:secretsmanager:arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:account/${InfrastructureName}/github:SecretString:oAuthToken}}"
            PollForSourceChanges: false
          OutputArtifacts:
          - Name: "GIT_SOURCE_FILES"
          RunOrder: 1
      - Name: "Test_Deploy"
        Actions:
        - Name: "Inline_StackSet_Deploy"
          ActionTypeId:
            Category: "Deploy"
            Owner: "AWS"
            Provider: "CloudFormation"
            Version: "1"
          Configuration:
            ActionMode: !Ref ActionMode
            StackName: !Sub "${InfrastructureName}-stackset-inline-${StackSetNameSuffix}"
            Capabilities: !Ref CloudFormationCapabilities
            TemplatePath:
              Fn::Sub:
              - "GIT_SOURCE_FILES::${Folder}iac/cfn/stackset/inline.yaml"
              - Folder: !If [ AppBaseFolder, !Sub "${AppBaseFolder}/", "" ]
            TemplateConfiguration:
              Fn::Sub:
              - "GIT_SOURCE_FILES::${Folder}env/cfn/stackset/inline/main.json"
              - Folder: !If [ AppBaseFolder, !Sub "${AppBaseFolder}/", "" ]
            RoleArn: !GetAtt DeployCodePipelineRole.Arn
            OutputFileName: "out.json"
            ParameterOverrides: !Sub
            - |
              {
                "InfrastructureName": "${InfrastructureName}",
                "AppBaseFolder": "${AppBaseFolder}",
                "StackSetName": "${StackSetNameSuffix}",
                "StackSetVersion": { "Fn::GetParam" : [ "GIT_SOURCE_FILES", "${Folder}${VersionFile}", "version" ] }
              }
            - Folder: !If [ AppBaseFolder, !Sub "${AppBaseFolder}/", "" ]
          InputArtifacts:
          - Name: "GIT_SOURCE_FILES"
          OutputArtifacts:
          - Name: "TEST_INLINE_STACKSET_OUTPUT"
          RunOrder: 1
          Region: !Ref "AWS::Region"
        - Name: "Content_Deploy"
          ActionTypeId:
            Category: "Deploy"
            Owner: "AWS"
            Provider: "S3"
            Version: "1"
          Configuration:
            BucketName: !Ref DeploymentBucketName
            CacheControl: !If [ CacheControl, !Ref CacheControl, !Ref "AWS::NoValue" ]
            Extract: !If [ ExtractFiles, true, false ]
            ObjectKey: !If [ BasePath, !Sub "${BasePath}/#{Source.CommitId}", !Ref "AWS::NoValue" ]
          InputArtifacts:
          - Name: "GIT_SOURCE_FILES"
          RunOrder: 2
          Region: !Ref "AWS::Region"
        - Name: "S3_StackSet_Deploy"
          ActionTypeId:
            Category: "Deploy"
            Owner: "AWS"
            Provider: "CloudFormation"
            Version: "1"
          Configuration:
            ActionMode: !Ref ActionMode
            StackName: !Sub "${InfrastructureName}-stackset-s3-${StackSetNameSuffix}"
            Capabilities: !Ref CloudFormationCapabilities
            TemplatePath:
              Fn::Sub:
              - "GIT_SOURCE_FILES::${Folder}iac/cfn/stackset/s3.yaml"
              - Folder: !If [ AppBaseFolder, !Sub "${AppBaseFolder}/", "" ]
            TemplateConfiguration:
              Fn::Sub:
              - "GIT_SOURCE_FILES::${Folder}env/cfn/stackset/s3/main.json"
              - Folder: !If [ AppBaseFolder, !Sub "${AppBaseFolder}/", "" ]
            RoleArn: !GetAtt DeployCodePipelineRole.Arn
            OutputFileName: "out.json"
            ParameterOverrides: !Sub
            - |
              {
                "InfrastructureName": "${InfrastructureName}",
                "AppBaseFolder": "${AppBaseFolder}",
                "StackSetName": "${StackSetNameSuffix}",
                "StackSetVersion": { "Fn::GetParam" : [ "GIT_SOURCE_FILES", "${Folder}${VersionFile}", "version" ] },
                "BucketName":"${DeploymentBucketName}",
                "BucketRegion":"${AWS::Region}",
                "BucketPath":"${BasePath}/#{Source.CommitId}/${Folder}iac/cfn",
                "BucketFile":"${DeploymentTemplate}"
              }
            - Folder: !If [ AppBaseFolder, !Sub "${AppBaseFolder}/", "" ]
          InputArtifacts:
          - Name: "GIT_SOURCE_FILES"
          OutputArtifacts:
          - Name: "TEST_S3_STACKSET_OUTPUT"
          RunOrder: 3
          Region: !Ref "AWS::Region"
      Tags:
      - Key: "Name"
        Value: !Ref "AWS::StackName"
      - Key: "application"
        Value: !Ref "AWS::StackName"
      - Key: "contact-email"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/contact-email}}"
      - Key: "customer"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/customer}}"
      - Key: "environment"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/environment}}"
      - Key: "team"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/team}}"
  GitHubWebhook:
    Type: "AWS::CodePipeline::Webhook"
    DependsOn: DeployCodePipeline
    Properties:
      Authentication: "GITHUB_HMAC"
      AuthenticationConfiguration:
        # Grabbing the UUID from the stack ID since it is random and nobody would know it unless you logged into the account and found the stack.
        SecretToken: !Select [ 2, !Split [ "/", !Ref "AWS::StackId" ] ]
      Filters:
      - JsonPath: "$.ref"
        MatchEquals: "refs/heads/{Branch}"
      TargetPipeline: !Ref DeployCodePipeline
      TargetAction: "GitHub_Source"
      Name: !Ref DeployCodePipeline
      TargetPipelineVersion: !GetAtt DeployCodePipeline.Version
      RegisterWithThirdParty: true
Outputs:
  SuggestedStackName:
    Description: "The suggested stack name for this template."
    Value: !Ref SuggestedStackName
    Export:
      Name: !Sub "${AWS::StackName}-SuggestedStackName"
  DeployCodePipelineRoleName:
    Description: "The CodePipeline role name."
    Value: !Ref DeployCodePipelineRole
    Export:
      Name: !Sub "${AWS::StackName}-DeployCodePipelineRoleName"
  DeployCodePipelineRoleArn:
    Description: "The CodePipeline Role ARN."
    Value: !GetAtt DeployCodePipelineRole.Arn
    Export:
      Name: !Sub "${AWS::StackName}-DeployCodePipelineRoleArn"
  DeployCodePipelineRoleId:
    Description: "The CodePipeline Role ID."
    Value: !GetAtt DeployCodePipelineRole.RoleId
    Export:
      Name: !Sub "${AWS::StackName}-DeployCodePipelineRoleId"
  DeployCodePipelineName:
    Description: "The deployment CodePipeline name."
    Value: !Ref DeployCodePipeline
    Export:
      Name: !Sub "${AWS::StackName}-DeployCodePipelineName"
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: "General Configuration"
      Parameters:
      - SuggestedStackName
      - InfrastructureName
      - StackSetNameSuffix 
    - Label:
        default: "CodePipeline Configuration"
      Parameters:
      - CloudFormationCapabilities
      - AppBaseFolder
      - ActionMode
      - VersionFile
    - Label:
        default: "Source Configuration"
      Parameters:
      - CodePipelineGitHubOrganization
      - CodePipelineSourceRepository
      - CodePipelineSourceBranch
    - Label:
        default: "Deployment Configuration"
      Parameters:
      - DeploymentBucketName
      - BasePath
      - CacheControl
      - ExtractFiles
      - DeploymentTemplate
    ParameterLabels:
      # General Configuration
      SuggestedStackName:
        default: "Suggested Stack Name:"
      InfrastructureName:
        default: "Infrastructure Name:"
      StackSetNameSuffix:
        default: "StackSet Name Suffix:"
      # CodePipeline Configuration
      CloudFormationCapabilities:
        default: "CloudFormation Capabilities:"
      AppBaseFolder:
        default: "Application Base Folder:"
      ActionMode:
        default: "Action Mode:"
      VersionFile:
        default: "Version File:"
      # Source Configuration
      CodePipelineGitHubOrganization:
        default: "CodePipeline GitHub Organization:"
      CodePipelineSourceRepository:
        default: "CodePipeline Source Repository:"
      CodePipelineSourceBranch:
        default: "CodePipeline Source Branch:"
      # Deployment Configuration
      BasePath:
        default: "Base Path:"
      DeploymentBucketName:
        default: "Deployment Bucket Name:"
      CacheControl:
        default: "Cache Control Header:"
      ExtractFiles:
        default: "Extract Files:"
      DeploymentTemplate:
        default: "Deployment Template:"