serverless-code-pipeline-cf-template.yml

# Copyright [2024] [Phil Chen]

# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at

#    http://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

AWSTemplateFormatVersion: 2010-09-09

Description: 'This solution allows you to create a AWS Codepipline for deploying a serverless application with AWS CodeBuild triggered by a Github repo commit. The setup of this solution is fully automated via a CloudFormation template.'

Parameters:
  Environment:
    AllowedValues:
    - dev
    - stg
    - prod
    Description: 'Environment'
    Type: 'String'
    Default: 'stg'

  CodePipelineBucketPrefix:
    Description: CodePipeline needs a utility bucket for its internal use. Specify a unique prefix for the bucket name
    Type: String
    Default: codepipeline-work-

  GitHubRepository:
    Type: String
    Default: getcft/aws-serverless-code-pipeline-cfn-template/master
    Description:  owner/repository/branch

  GitHubOAuthToken:
    Type: String
    NoEcho: true
    Description:  CodePipeline requires an GitHub OAuthToken

Resources:

  CodeBuildRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName:
        'Fn::Join': [ "", ["CodeBuildRole", "-", !Ref 'AWS::StackName', "-", !Ref 'Environment']]
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: "Allow"
          Principal:
            Service: "codebuild.amazonaws.com"
          Action: "sts:AssumeRole"

  CodePipelineRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName:
        'Fn::Join': [ "", ["CodePipelineRole", "-", !Ref 'AWS::StackName', "-", !Ref 'Environment']]
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: "Allow"
          Principal:
            Service: "codepipeline.amazonaws.com"
          Action: "sts:AssumeRole"

  # This can be restricted more
  CodeBuildPolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName:
        'Fn::Join': [ "", ["CodeBuildPolicy", "-", !Ref 'AWS::StackName', "-", !Ref 'Environment']]
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: Allow
          Action:
            - 'logs:*'
            - 'codebuild:*'
            - 'cloudformation:*'
            - 'lambda:*'
            - 'apigateway:*'
            - 's3:*'
            - 'iam:PassRole'
            - 'iam:GetRole'
            - 'iam:CreateRole'
            - 'iam:PutRolePolicy'
            - 'iam:DeleteRolePolicy'
            - 'iam:DeleteRole'
            - 'iam:TagRole'
            - 'events:Put*'
            - 'events:Remove*'
            - 'events:Delete*'
          Resource: "*"
      Roles:
        -  !Ref CodeBuildRole

  CodePipelinePolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName:
        'Fn::Join': [ "", ["CodePipelinePolicy", "-", !Ref 'AWS::StackName', "-", !Ref 'Environment']]
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: Allow
          Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            - s3:putObject
            - s3:getObject
            - codebuild:*
          Resource:
            - "*"
      Roles:
        -  !Ref CodePipelineRole

  S3:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Join [ "", [!Ref CodePipelineBucketPrefix, !Ref 'Environment', "-", !Ref "AWS::Region"]]

  TestBuild:
    Type: "AWS::CodeBuild::Project"
    Properties:
      Name: Test-Build
      Description: Demo of CodeBuild with CodeDeploy pipeline.
      ServiceRole: !Ref CodeBuildRole
      TimeoutInMinutes: 5
      Source:
        Type: CODEPIPELINE
        BuildSpec: !Join [ "", ["buildspec", "-", !Ref 'Environment', ".yml"]]
      Environment:
        Type: "LINUX_CONTAINER"
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:7.0
      Artifacts:
        Type: CODEPIPELINE

  BuildDeploy:
    Type: "AWS::CodeBuild::Project"
    Properties:
      Name: Build-Deploy
      Description: Demo of CodeBuild with CodeDeploy pipeline.
      ServiceRole: !Ref CodeBuildRole
      TimeoutInMinutes: 5
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
            version: 0.2
            phases:
              build:
                commands:
                  - n 18.19.0
                  - npm install --silent --progress-false
                  - npm install --silent --progress=false -g serverless@3.38.0-d09dc659
                  - npm install --silent --save–dev serverless-stack-output
                  - serverless deploy
      Environment:
        Type: "LINUX_CONTAINER"
        ComputeType: BUILD_GENERAL1_SMALL
        EnvironmentVariables:
          - Name: env
            Type: PLAINTEXT
            Value: !Ref Environment
        Image: aws/codebuild/standard:7.0
      Artifacts:
        Type: CODEPIPELINE

  # CodePipeline with its stages:
  Pipeline:
    Type: "AWS::CodePipeline::Pipeline"
    Properties:
      Name: !Join [ "", ["DevOps-Pipeline", "-", !Ref 'AWS::StackName'] ]
      ArtifactStore:
        Location: !Ref S3
        Type: S3
      RestartExecutionOnUpdate: true
      RoleArn: !Join [ "", ["arn:aws:iam::", !Ref "AWS::AccountId", ":role/", !Ref CodePipelineRole  ] ]
      Stages:

        # Stage 1:  Get the source from GitHub:
        - Name: Source
          Actions:
            - Name: SourceAction
              RunOrder: 1
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Provider: GitHub
                Version: 1
              Configuration:
                Owner: !Select [0, !Split [ "/" , !Ref GitHubRepository ]]
                Repo: !Select [1, !Split [ "/" , !Ref GitHubRepository ]]
                Branch: !Select [2, !Split [ "/" , !Ref GitHubRepository ]]
                PollForSourceChanges: true
                OAuthToken: !Ref GitHubOAuthToken
              OutputArtifacts:
                - Name: TheSourceCode

        # Stage 2: Run Your Tests
        - Name: TestBuild
          Actions:
            - Name: Test-Build
              RunOrder: 1
              InputArtifacts:
                - Name: TheSourceCode
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              Configuration:
                ProjectName:  !Ref TestBuild
              OutputArtifacts:
                - Name: TheArtifact

        # Stage 3:  Build and Deploy using Serverless Framework
        - Name: BuildDeploy
          Actions:
            - Name: Build-Deploy
              RunOrder: 1
              InputArtifacts:
                - Name: TheArtifact
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              Configuration:
                ProjectName:  !Ref BuildDeploy
              OutputArtifacts:
                - Name: TheArtifact2

Outputs:
  CodeBuild:
    Value: !Ref Pipeline
  Environment:
    Value: !Ref Environment
  Github:
    Value: !Ref GitHubRepository
  CodeBuildRole:
    Value: !Ref CodeBuildRole
  CodeBuildPolicy:
    Value: !Ref CodeBuildPolicy
  CodePipelineRole:
    Value: !Ref CodePipelineRole
  CodePipelinePolicy:
    Value: !Ref CodePipelinePolicy
  S3:
    Value: !Ref S3