pipeline.yml

Parameters:
  GitHubRepo:
    Type: String
  GitHubBranch:
    Type: String
  GitHubToken:
    Type: String
    NoEcho: true
  GitHubUser:
    Type: String
  EnvironmentName:
    Type: String
  CertificateArn:
    Type: String
    Description: ARN of the Amazon Certificate Manager SSL certificate to use for this app

Resources:
  # Create the ECR respository to hold built docker images
  Repository:
    Type: AWS::ECR::Repository
    DeletionPolicy: Retain

  # A role used to give CodeBuild permission to access code,
  # build it, and upload the build results to ECR
  CodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource: "*"
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - ecr:GetAuthorizationToken
              - Resource: !Sub arn:aws:s3:::${ArtifactBucket}/*
                Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:GetObjectVersion
              - Resource: !Sub arn:aws:ecr:${AWS::Region}:${AWS::AccountId}:repository/${Repository}
                Effect: Allow
                Action:
                  - ecr:GetDownloadUrlForLayer
                  - ecr:BatchGetImage
                  - ecr:BatchCheckLayerAvailability
                  - ecr:PutImage
                  - ecr:InitiateLayerUpload
                  - ecr:UploadLayerPart
                  - ecr:CompleteLayerUpload

  # Role used to give CodePipeline to release a build.
  CodePipelineServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codepipeline.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              # Allow codepipeline to put artifacts in the S3 bucket
              # as well as get artifacts back out of it.
              - Resource:
                  - !Sub arn:aws:s3:::${ArtifactBucket}/*
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
              # Allow codepipeline to build code builds
              - Resource: "*"
                Effect: Allow
                Action:
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds
                  - iam:PassRole
              # Allow codepipeline to deploy cloudformation stacks
              - Effect: Allow
                Action:
                  - cloudformation:CreateChangeSet
                  - cloudformation:CreateStack
                  - cloudformation:CreateUploadBucket
                  - cloudformation:DeleteStack
                  - cloudformation:Describe*
                  - cloudformation:List*
                  - cloudformation:UpdateStack
                  - cloudformation:ValidateTemplate
                  - cloudformation:ExecuteChangeSet
                Resource: "*"

  # CloudFormation deployment role. This role is passed by CodeBuild to
  # CloudFormation to use when setting up the application resources
  CloudFormationDeployRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: deploy-stack
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - "iam:*"
                  - "ec2:*"
                  - "ecs:*"
                  - "elasticloadbalancing:*"
                  - "autoscaling:*"
                  - "dynamodb:*"
                  - "elasticache:*"
                  - "logs:*"
                  - "application-autoscaling:*"
                  - "cloudwatch:*"
                  - "route53:*"
                Resource: "*"

  # While the build is in progress we need a place to store artifacts
  ArtifactBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain

  # This is the definition of how to build the code in the repository
  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            pre_build:
              commands:
                - $(aws ecr get-login --no-include-email)
                - TAG="$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | head -c 8)"
                - IMAGE_URI="${REPOSITORY_URI}:${TAG}"
            build:
              commands:
                - docker build --tag "${IMAGE_URI}" ./services/client
            post_build:
              commands:
                - docker push "$IMAGE_URI"
                - printf '{"ImageUri":"%s"}' "$IMAGE_URI" > build.json
          artifacts:
            files: build.json
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/docker:17.09.0
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: AWS_DEFAULT_REGION
            Value: !Ref AWS::Region
          - Name: REPOSITORY_URI
            Value: !Sub ${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${Repository}
      Name: !Ref AWS::StackName
      ServiceRole: !Ref CodeBuildServiceRole

  # This pipeline defines the steps to build, deploy, and release the application
  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactBucket
      Stages:

        # First we have to pull the source code from the Github repository.
        - Name: Source
          Actions:
            - Name: App
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: 1
                Provider: GitHub
              Configuration:
                Owner: !Ref GitHubUser
                Repo: !Ref GitHubRepo
                Branch: !Ref GitHubBranch
                OAuthToken: !Ref GitHubToken
              OutputArtifacts:
                - Name: Source
              RunOrder: 1

        # Now we deploy the base resources: the cluster and VPC itself.
        - Name: BaseResources
          Actions:
            - Name: Deploy
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                ActionMode: CREATE_UPDATE
                RoleArn: !GetAtt CloudFormationDeployRole.Arn
                StackName: !Sub ${EnvironmentName}-BaseResources
                TemplatePath: Source::cluster.yml
                Capabilities: CAPABILITY_IAM
                ParameterOverrides: !Sub |
                  {
                    "EnvironmentName": "${EnvironmentName}",
                    "CertificateArn": "${CertificateArn}"
                  }
              InputArtifacts:
                - Name: Source
              OutputArtifacts:
                - Name: BaseResources

        # And we deploy the application resources (Elasticache, DynamoDB, etc)
        - Name: ChatResources
          Actions:
            # Deploy the chat resources
            - Name: Deploy
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                ActionMode: CREATE_UPDATE
                RoleArn: !GetAtt CloudFormationDeployRole.Arn
                StackName: !Sub ${EnvironmentName}-ChatResources
                TemplatePath: Source::resources.yml
                Capabilities: CAPABILITY_IAM
                ParameterOverrides: !Sub |
                  {
                    "EnvironmentName": "${EnvironmentName}"
                  }
              InputArtifacts:
                - Name: Source
              OutputArtifacts:
                - Name: ChatResources

            # And build the chat docker image
            - Name: Build
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref CodeBuildProject
              InputArtifacts:
                - Name: Source
              OutputArtifacts:
                - Name: BuildOutput
              RunOrder: 1

        # Finally we deploy the Fargate service to the cluster
        - Name: Deploy
          Actions:
            - Name: Deploy
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                ActionMode: CREATE_UPDATE
                RoleArn: !GetAtt CloudFormationDeployRole.Arn
                StackName: !Sub ${EnvironmentName}-ChatService
                TemplatePath: Source::chat-service.yml
                Capabilities: CAPABILITY_IAM
                ParameterOverrides: !Sub |
                  {
                    "EnvironmentName": "${EnvironmentName}",
                    "ImageUrl": {
                      "Fn::GetParam" : ["BuildOutput", "build.json", "ImageUri"]
                    }
                  }
              InputArtifacts:
                - Name: Source
                - Name: BuildOutput

Outputs:
  PipelineUrl:
    Value: !Sub https://console.aws.amazon.com/codepipeline/home?region=${AWS::Region}#/view/${Pipeline}