08_pipeline.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Part 3 - Setup a CodePipeline with CloudFormation

Parameters:
  GitHubRepo:
    Type: String

  GitHubBranch:
    Type: String
    Default: main

  GitHubUser:
    Type: String

  CodeDeployServiceRole:
    Type: String
    Description: A service role ARN granting CodeDeploy permission to make calls to EC2 instances with CodeDeploy agent installed.

  TagKey:
    Description: The EC2 tag key that identifies this as a target for deployments.
    Type: String
    Default: CodeDeployTag
    AllowedPattern: '[\x20-\x7E]*'
    ConstraintDescription: Can contain only ASCII characters.
  TagValue:
    Description: The EC2 tag value that identifies this as a target for deployments.
    Type: String
    Default: CodeDeployDemo
    AllowedPattern: '[\x20-\x7E]*'
    ConstraintDescription: Can contain only ASCII characters.

Resources:

  CodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: "logs"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
                -
                  Effect: "Allow"
                  Action:
                      - logs:CreateLogGroup
                      - logs:CreateLogStream
                      - logs:PutLogEvents
                      - ecr:GetAuthorizationToken
                      - ssm:GetParameters
                  Resource: "*"
        - PolicyName: "S3"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
                -
                  Effect: "Allow"
                  Action:
                      - s3:GetObject
                      - s3:PutObject
                      - s3:GetObjectVersion
                  Resource: !Sub arn:aws:s3:::${ArtifactBucket}/*

  CodePipelineServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codepipeline.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource:
                  - !Sub arn:aws:s3:::${ArtifactBucket}/*
                  - !Sub arn:aws:s3:::${ArtifactBucket}
                Effect: Allow
                Action:
                  - s3:*
              - Resource: "*"
                Effect: Allow
                Action:
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds
                  - iam:PassRole
              - Resource:
                  - !Ref CodeStarConnection
                Effect: Allow
                Action:
                  - codestar-connections:UseConnection
              - Resource: "*"
                Effect: Allow
                Action:
                  - codedeploy:CreateDeployment
                  - codedeploy:CreateDeploymentGroup
                  - codedeploy:GetApplication
                  - codedeploy:GetApplicationRevision
                  - codedeploy:GetDeployment
                  - codedeploy:GetDeploymentConfig
                  - codedeploy:RegisterApplicationRevision

  ArtifactBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete

  CodeStarConnection:
    Type: 'AWS::CodeStarConnections::Connection'
    Properties:
      ConnectionName: CfnExamplesGitHubConnection
      ProviderType: GitHub

  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: buildspec.yml
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/docker:17.09.0
        Type: LINUX_CONTAINER
      Name: !Ref AWS::StackName
      ServiceRole: !Ref CodeBuildServiceRole

  CodeDeployApplication:
    Type: AWS::CodeDeploy::Application

  CodeDeployGroup:
    Type: AWS::CodeDeploy::DeploymentGroup
    Properties:
      ApplicationName: !Ref CodeDeployApplication
      Ec2TagFilters:
        - Key: !Ref 'TagKey'
          Value: !Ref 'TagValue'
          Type: KEY_AND_VALUE
      ServiceRoleArn: !Ref 'CodeDeployServiceRole'

  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactBucket
      Stages:
        - Name: Source
          Actions:
            - Name: App
              ActionTypeId:
                Category: Source
                Owner: AWS
                Version: '1'
                Provider: CodeStarSourceConnection
              Configuration:
                ConnectionArn: !Ref CodeStarConnection
                BranchName: !Ref GitHubBranch
                FullRepositoryId: !Sub ${GitHubUser}/${GitHubRepo}
              OutputArtifacts:
                - Name: AppArtifact
              RunOrder: 1
        - Name: Build
          Actions:
            - Name: Build
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: '1'
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref CodeBuildProject
              InputArtifacts:
                - Name: AppArtifact
              OutputArtifacts:
                - Name: BuildOutput
              RunOrder: 1
        - Name: Deploy
          Actions:
            - Name: Deploy
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: '1'
                Provider: CodeDeploy
              Configuration:
                ApplicationName: !Ref CodeDeployApplication
                DeploymentGroupName: !Ref CodeDeployGroup
              InputArtifacts:
                - Name: BuildOutput
              RunOrder: 1

Outputs:
  PipelineUrl:
    Value: !Sub https://console.aws.amazon.com/codepipeline/home?region=${AWS::Region}#/view/${Pipeline}