codestar-template.yml

AWSTemplateFormatVersion: 2010-09-09
Conditions:
  CreateCodeBuildResources: !Equals
  - true
  - true
  CreateWebSiteS3Bucket: !Equals
  - false
  - true
Description: A Node.js web service deployed to AWS Lambda.
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: Application
      Parameters:
      - ProjectId
  CodeBuildImage: aws/codebuild/eb-nodejs-6.10.0-amazonlinux-64:4.0.0
  CodeBuildImageOverride: aws/codebuild/eb-nodejs-6.10.0-amazonlinux-64:4.0.0
  IsWebsite: false
  ProjectTemplateId: webservice-nodeexpress-lambda
  WebsiteS3Bucket: !Ref 'WebsiteS3Bucket'
Outputs:
  LambdaTrustRole:
    Description: AWS CodeStar role for AWS Lambda used for passRole to Lambda functions.
    Export:
      Name: !Join
      - '-'
      - - !Ref 'ProjectId'
        - !Ref 'AWS::Region'
        - LambdaTrustRole
    Value: !GetAtt 'LambdaTrustRole.Arn'
Parameters:
  AppName:
    Description: Name of the application.
    MaxLength: 100
    MinLength: 1
    Type: String
  ProjectId:
    AllowedPattern: ^[a-z]([a-z0-9-])+$
    ConstraintDescription: Project IDs must be between 2 and 15 characters, begin with a letter, and only contain lowercase letters, numbers, and hyphens (-).
    Description: Project ID.
    MaxLength: 15
    MinLength: 2
    Type: String
  RepositoryBranch:
    Default: master
    Description: GitHub branch name.
    Type: String
  RepositoryEnableIssues:
    AllowedValues:
    - true
    - false
    Default: false
    Description: Whether the GitHub issues tile is enabled.
    Type: String
  RepositoryName:
    Description: GitHub repository name.
    MaxLength: 100
    MinLength: 1
    Type: String
  RepositoryProvider:
    Default: GitHub
    Description: Repository provider.
    Type: String
  RepositoryProviderUserId:
    Description: GitHub user ID.
    Type: String
  RepositoryProviderUsername:
    Description: GitHub user name.
    Type: String
  RepositoryToken:
    Description: GitHub access token.
    NoEcho: true
    Type: String
  RepositoryURL:
    Description: GitHub repository URL.
    Type: String
Resources:
  CloudFormationTrustRole:
    Description: Creating service role in IAM for AWS CloudFormation
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - cloudformation.amazonaws.com
      Path: /
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - s3:PutObject
            - s3:GetObject
            - s3:GetObjectVersion
            Effect: Allow
            Resource:
            - !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref 'S3Bucket'
            - !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref 'S3Bucket'
                - /*
          - Action:
            - codestar:SyncResources
            - lambda:CreateFunction
            - lambda:DeleteFunction
            - lambda:AddPermission
            - lambda:UpdateFunction
            - lambda:UpdateFunctionCode
            - lambda:GetFunction
            - lambda:GetFunctionConfiguration
            - lambda:UpdateFunctionConfiguration
            - lambda:RemovePermission
            - lambda:listTags
            - lambda:TagResource
            - lambda:UntagResource
            - apigateway:*
            - dynamodb:CreateTable
            - dynamodb:DeleteTable
            - dynamodb:DescribeTable
            - kinesis:CreateStream
            - kinesis:DeleteStream
            - kinesis:DescribeStream
            - sns:CreateTopic
            - sns:DeleteTopic
            - sns:ListTopics
            - sns:GetTopicAttributes
            - sns:SetTopicAttributes
            - s3:CreateBucket
            - s3:DeleteBucket
            - config:DescribeConfigRules
            - config:PutConfigRule
            - config:DeleteConfigRule
            Effect: Allow
            Resource: '*'
          - Action:
            - iam:PassRole
            Effect: Allow
            Resource:
            - !GetAtt
              - LambdaTrustRole
              - Arn
          - Action:
            - cloudformation:CreateChangeSet
            Effect: Allow
            Resource:
            - arn:aws:cloudformation:us-east-1:aws:transform/Serverless-2016-10-31
            - arn:aws:cloudformation:us-east-1:aws:transform/CodeStar
        PolicyName: CodeStarWorkerCloudFormationRolePolicy
      RoleName: !Join
      - '-'
      - - CodeStarWorker
        - !Ref 'ProjectId'
        - CloudFormation
    Type: AWS::IAM::Role
  CodeBuildPolicy:
    Condition: CreateCodeBuildResources
    Description: Setting IAM policy for service role for Amazon EC2 instances
    Properties:
      PolicyDocument:
        Statement:
        - Action:
          - logs:CreateLogGroup
          - logs:CreateLogStream
          - logs:PutLogEvents
          Effect: Allow
          Resource: '*'
        - Action:
          - s3:PutObject
          - s3:GetObject
          - s3:GetObjectVersion
          Effect: Allow
          Resource:
          - !Join
            - ''
            - - 'arn:aws:s3:::'
              - !Ref 'S3Bucket'
          - !Join
            - ''
            - - 'arn:aws:s3:::'
              - !Ref 'S3Bucket'
              - /*
        - !If
          - CreateWebSiteS3Bucket
          - Action:
            - s3:PutObject*
            - s3:GetObject
            - s3:GetObjectVersion
            Effect: Allow
            Resource:
            - !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref 'WebsiteS3Bucket'
            - !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref 'WebsiteS3Bucket'
                - /*
          - !Ref 'AWS::NoValue'
        - Action:
          - kms:GenerateDataKey*
          - kms:Encrypt
          - kms:Decrypt
          Effect: Allow
          Resource:
          - !Join
            - ':'
            - - arn:aws:kms
              - !Ref 'AWS::Region'
              - !Ref 'AWS::AccountId'
              - !Join
                - /
                - - alias
                  - aws/s3
      PolicyName: CodeStarWorkerCodeBuildPolicy
      Roles:
      - !Ref 'CodeBuildRole'
    Type: AWS::IAM::Policy
  CodeBuildProject:
    Condition: CreateCodeBuildResources
    DependsOn:
    - CodeBuildPolicy
    Properties:
      Artifacts:
        Packaging: zip
        Type: codepipeline
      Description: !Join
      - ''
      - - 'AWS CodeStar created CodeBuild Project for '
        - !Ref 'AppName'
      Environment:
        ComputeType: small
        EnvironmentVariables:
        - Name: S3_BUCKET
          Value: !Ref 'S3Bucket'
        - Name: WEBSITE_S3_PREFIX
          Value: !If
          - CreateWebSiteS3Bucket
          - !Join
            - ''
            - - https://s3.amazonaws.com/
              - !Ref 'WebsiteS3Bucket'
          - NoVal
        - Name: WEBSITE_S3_BUCKET
          Value: !If
          - CreateWebSiteS3Bucket
          - !Ref 'WebsiteS3Bucket'
          - NoVal
        Image: aws/codebuild/eb-nodejs-6.10.0-amazonlinux-64:4.0.0
        Type: container
      Name: !Ref 'ProjectId'
      ServiceRole: !Ref 'CodeBuildRole'
      Source:
        Type: codepipeline
    Type: AWS::CodeBuild::Project
  CodeBuildRole:
    Condition: CreateCodeBuildResources
    Description: Creating service role in IAM for Amazon EC2 instances
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: codebuild.amazonaws.com
      Path: /
      RoleName: !Join
      - '-'
      - - CodeStarWorker
        - !Ref 'ProjectId'
        - CodeBuild
    Type: AWS::IAM::Role
  CodePipelineTrustRole:
    Description: Creating service role in IAM for AWS CodePipeline
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - codepipeline.amazonaws.com
          Sid: 1
      Path: /
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - s3:GetObject
            - s3:GetObjectVersion
            - s3:GetBucketVersioning
            - s3:PutObject
            Effect: Allow
            Resource:
            - !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref 'S3Bucket'
            - !Join
              - ''
              - - 'arn:aws:s3:::'
                - !Ref 'S3Bucket'
                - /*
          - Action:
            - codebuild:StartBuild
            - codebuild:BatchGetBuilds
            - codebuild:StopBuild
            Effect: Allow
            Resource:
            - !GetAtt 'CodeBuildProject.Arn'
          - Action:
            - cloudformation:DescribeStacks
            - cloudformation:DescribeChangeSet
            - cloudformation:CreateChangeSet
            - cloudformation:DeleteChangeSet
            - cloudformation:ExecuteChangeSet
            Effect: Allow
            Resource:
            - !Join
              - ':'
              - - arn
                - aws
                - cloudformation
                - !Ref 'AWS::Region'
                - !Ref 'AWS::AccountId'
                - !Join
                  - /
                  - - stack
                    - !Join
                      - '-'
                      - - awscodestar
                        - !Ref 'ProjectId'
                        - lambda
                    - '*'
          - Action:
            - iam:PassRole
            Effect: Allow
            Resource:
            - !GetAtt
              - CloudFormationTrustRole
              - Arn
        PolicyName: CodeStarWorkerCodePipelineRolePolicy
      RoleName: !Join
      - '-'
      - - CodeStarWorker
        - !Ref 'ProjectId'
        - CodePipeline
    Type: AWS::IAM::Role
  CodeStarProject:
    Description: Starting project creation
    Properties:
      ProjectDescription: AWS CodeStar created project
      ProjectId: !Ref 'ProjectId'
      ProjectName: !Ref 'AppName'
      ProjectTemplateId: arn:aws:codestar:us-east-1::project-template/github/webservice-nodeexpress-lambda
      StackId: !Ref 'AWS::StackId'
    Type: AWS::CodeStar::Project
    Version: 1.0
  LambdaTrustRole:
    Description: Creating service role in IAM for AWS Lambda
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      - arn:aws:iam::aws:policy/service-role/AWSConfigRulesExecutionRole
      Path: /
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Effect: Allow
            Resource: '*'
          Version: 2012-10-17
        PolicyName: CodeStarLambdaWorkerPolicy
      RoleName: !Join
      - '-'
      - - CodeStarWorker
        - !Ref 'ProjectId'
        - Lambda
    Type: AWS::IAM::Role
  ProjectPipeline:
    DependsOn:
    - SeedRepo
    - LambdaTrustRole
    - CodePipelineTrustRole
    - S3Bucket
    - CodeBuildProject
    - CloudFormationTrustRole
    Description: Creating a deployment pipeline for your project in AWS CodePipeline
    Properties:
      ArtifactStore:
        Location: !Ref 'S3Bucket'
        Type: S3
      Name: !Join
      - '-'
      - - !Ref 'ProjectId'
        - Pipeline
      RoleArn: !GetAtt
      - CodePipelineTrustRole
      - Arn
      Stages:
      - Actions:
        - ActionTypeId:
            Category: Source
            Owner: ThirdParty
            Provider: GitHub
            Version: 1
          Configuration:
            Branch: !Ref 'RepositoryBranch'
            OAuthToken: !Ref 'RepositoryToken'
            Owner: !Ref 'RepositoryProviderUsername'
            Repo: !Ref 'RepositoryName'
          InputArtifacts: [
            ]
          Name: ApplicationSource
          OutputArtifacts:
          - Name: !Join
            - '-'
            - - !Ref 'ProjectId'
              - SourceArtifact
          RunOrder: 1
        Name: Source
      - Actions:
        - ActionTypeId:
            Category: Build
            Owner: AWS
            Provider: CodeBuild
            Version: 1
          Configuration:
            ProjectName: !Ref 'ProjectId'
          InputArtifacts:
          - Name: !Join
            - '-'
            - - !Ref 'ProjectId'
              - SourceArtifact
          Name: PackageExport
          OutputArtifacts:
          - Name: !Join
            - '-'
            - - !Ref 'ProjectId'
              - BuildArtifact
          RunOrder: 1
        Name: Build
      - Actions:
        - ActionTypeId:
            Category: Deploy
            Owner: AWS
            Provider: CloudFormation
            Version: 1
          Configuration:
            ActionMode: CHANGE_SET_REPLACE
            Capabilities: CAPABILITY_IAM
            ChangeSetName: pipeline-changeset
            ParameterOverrides: !Join
            - ''
            - - '{"ProjectId":"'
              - !Ref 'ProjectId'
              - '"}'
            RoleArn: !GetAtt
            - CloudFormationTrustRole
            - Arn
            StackName: !Join
            - '-'
            - - awscodestar
              - !Ref 'ProjectId'
              - lambda
            TemplatePath: !Join
            - ''
            - - !Ref 'ProjectId'
              - -BuildArtifact
              - ::template-export.yml
          InputArtifacts:
          - Name: !Join
            - '-'
            - - !Ref 'ProjectId'
              - BuildArtifact
          Name: GenerateChangeSet
          OutputArtifacts: [
            ]
          RunOrder: 1
        - ActionTypeId:
            Category: Deploy
            Owner: AWS
            Provider: CloudFormation
            Version: 1
          Configuration:
            ActionMode: CHANGE_SET_EXECUTE
            ChangeSetName: pipeline-changeset
            StackName: !Join
            - '-'
            - - awscodestar
              - !Ref 'ProjectId'
              - lambda
          InputArtifacts: [
            ]
          Name: ExecuteChangeSet
          OutputArtifacts: [
            ]
          RunOrder: 2
        Name: Deploy
    Type: AWS::CodePipeline::Pipeline
  S3ArtifactBucketPolicy:
    Description: Setting Amazon S3 bucket policy for AWS CodePipeline access
    Properties:
      Bucket: !Ref 'S3Bucket'
      PolicyDocument:
        Id: SSEAndSSLPolicy
        Statement:
        - Action:
          - s3:GetObject
          - s3:GetObjectVersion
          - s3:GetBucketVersioning
          Condition:
            Bool:
              aws:SecureTransport: false
          Effect: Allow
          Principal:
            AWS:
            - !GetAtt
              - CodePipelineTrustRole
              - Arn
            - !GetAtt
              - CodeBuildRole
              - Arn
            - !GetAtt
              - CloudFormationTrustRole
              - Arn
          Resource:
          - !Join
            - ''
            - - 'arn:aws:s3:::'
              - !Ref 'S3Bucket'
          - !Join
            - ''
            - - 'arn:aws:s3:::'
              - !Ref 'S3Bucket'
              - /*
          Sid: WhitelistedGet
        - Action:
          - s3:PutObject
          Effect: Allow
          Principal:
            AWS:
            - !GetAtt
              - CodePipelineTrustRole
              - Arn
            - !GetAtt
              - CodeBuildRole
              - Arn
          Resource:
          - !Join
            - ''
            - - 'arn:aws:s3:::'
              - !Ref 'S3Bucket'
          - !Join
            - ''
            - - 'arn:aws:s3:::'
              - !Ref 'S3Bucket'
              - /*
          Sid: WhitelistedPut
        Version: 2012-10-17
    Type: AWS::S3::BucketPolicy
  S3Bucket:
    DeletionPolicy: Retain
    Description: Creating Amazon S3 bucket for AWS CodePipeline artifacts
    Properties:
      BucketName: !Join
      - '-'
      - - aws
        - codestar
        - !Ref 'AWS::Region'
        - !Ref 'AWS::AccountId'
        - !Ref 'ProjectId'
        - pipe
      Tags:
      - Key: Name
        Value: !Join
        - '-'
        - - !Ref 'ProjectId'
          - S3Bucket
      VersioningConfiguration:
        Status: Enabled
    Type: AWS::S3::Bucket
  SeedRepo:
    DeletionPolicy: Retain
    Description: Adding application source code to the GitHub repository for the project.
    Properties:
      DefaultBranchName: !Ref 'RepositoryBranch'
      ProjectId: !Ref 'ProjectId'
      ProjectTemplateId: arn:aws:codestar:us-east-1::project-template/github/webservice-nodeexpress-lambda
      RepositoryProvider: !Ref 'RepositoryProvider'
      RepositoryProviderUsername: !Ref 'RepositoryProviderUsername'
      RepositoryToken: !Ref 'RepositoryToken'
      RepositoryURL: !Ref 'RepositoryURL'
    Type: AWS::CodeStar::SeedRepository
  SyncInitialResources:
    DependsOn:
    - SeedRepo
    Description: Getting GitHub issues tile settings for your AWS CodeStar project.
    Properties:
      ProjectId: !Ref 'ProjectId'
    Type: AWS::CodeStar::SyncResources
    Version: 1.0
  SyncResources:
    DependsOn:
    - SeedRepo
    - CodeBuildProject
    - ProjectPipeline
    - SyncInitialResources
    Description: Adding all created resources to your AWS CodeStar project
    Properties:
      ProjectId: !Ref 'ProjectId'
    Type: AWS::CodeStar::SyncResources
    Version: 1.0
  WebsiteS3Bucket:
    Condition: CreateWebSiteS3Bucket
    DeletionPolicy: Retain
    Description: Creating Amazon S3 bucket for Website static artifacts
    Properties:
      BucketName: !Join
      - '-'
      - - aws
        - codestar
        - !Ref 'AWS::Region'
        - !Ref 'AWS::AccountId'
        - !Ref 'ProjectId'
        - app
      Tags:
      - Key: Name
        Value: !Join
        - '-'
        - - !Ref 'ProjectId'
          - WebsiteS3Bucket
      VersioningConfiguration:
        Status: Enabled
    Type: AWS::S3::Bucket