pipeline_simple.yaml

AWSTemplateFormatVersion: 2010-09-09
Parameters:
  ServiceName:
    Type: String
    Default: ServerlessDemo
    Description: Name for the service, used in the code repository, Lambda function, and pipeline names
Resources:
  # Code repository for the service
  CodeRepository:
    Type: AWS::CodeCommit::Repository
    Properties:
      RepositoryName: !Sub '${ServiceName}_repo'
      RepositoryDescription: !Sub 'Repository for the ${ServiceName} service'

  # CodeBuild project and resources (S3 Bucket for build artifacts, Role, Project)
  BuildArtifactsBucket:
    Type: AWS::S3::Bucket
  CodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action: 
            - 'sts:AssumeRole'
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
      Path: /
      Policies:
        - PolicyName: CodeBuildAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Resource:
                  - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ServiceName}_build'
                  - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ServiceName}_build:*'
                Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
              - Effect: Allow
                Resource:
                  - !Sub 'arn:aws:s3:::${BuildArtifactsBucket}/*'
                Action: 
                  - 's3:GetObject'
                  - 's3:GetObjectVersion'
                  - 's3:PutObject'
  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub '${ServiceName}_build'
      Description: Build project for the Lambda service
      Artifacts:
        Type: CODEPIPELINE
      Environment: 
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/eb-nodejs-6.10.0-amazonlinux-64:4.0.0
        EnvironmentVariables:
          - Name: BUILD_OUTPUT_BUCKET
            Value: !Ref BuildArtifactsBucket
      ServiceRole: !GetAtt CodeBuildServiceRole.Arn
      Source: 
        Type: CODEPIPELINE
  
  # CodePipeline definition and required roles
  CFNPipelinePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: CloudFormation Pipeline Execution Policy
      Path: "/"
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          Effect: Allow
          Action: 
            - 'cloudformation:CreateStack'
            - 'cloudformation:DescribeStacks'
            - 'cloudformation:DeleteStack'
            - 'cloudformation:UpdateStack'
            - 'cloudformation:CreateChangeSet'
            - 'cloudformation:ExecuteChangeSet'
            - 'cloudformation:DeleteChangeSet'
            - 'cloudformation:DescribeChangeSet'
            - 'cloudformation:SetStackPolicy'
            - 'cloudformation:SetStackPolicy'
            - 'cloudformation:ValidateTemplate'
            - 'codebuild:StartBuild'
            - 'codebuild:BatchGetBuilds'
          Resource: "*"
  CloudFormationExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          Action: 
            - 'sts:AssumeRole'
          Effect: Allow
          Principal:
            Service:
              - cloudformation.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AdministratorAccess'
  PipelineExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action: 
            - 'sts:AssumeRole'
            Effect: Allow
            Principal:
              Service: 
                - codepipeline.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AWSCodeCommitFullAccess'
        - 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
        - !Ref CFNPipelinePolicy
      Policies:
        - PolicyName: CodePipelineAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 'iam:PassRole'
                - 'lambda:InvokeFunction'
                - 'lambda:ListFunctions'
                - 'lambda:InvokeAsyc'
                Effect: Allow
                Resource: '*'
  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      ArtifactStore: 
        Location: !Ref BuildArtifactsBucket
        Type: S3
      Name: !Sub ${ServiceName}_pipeline
      RoleArn: !GetAtt PipelineExecutionRole.Arn
      Stages:
        - Name: Source
          Actions:
          - Name: CodeCommitRepo
            ActionTypeId:
              Category: Source
              Owner: AWS
              Provider: CodeCommit
              Version: 1
            Configuration:
              RepositoryName: !Sub '${ServiceName}_repo'
              BranchName: master
            OutputArtifacts:
            - Name: SourceZip
            RunOrder: 1
        - Name: Build
          Actions:
          - Name: CodeBuild
            ActionTypeId:
              Category: Build
              Owner: AWS
              Provider: CodeBuild
              Version: 1
            Configuration:
              ProjectName: !Ref CodeBuildProject
            InputArtifacts:
            - Name: SourceZip
            OutputArtifacts:
            - Name: BuiltZip
        - Name: CloudFormation
          Actions:
          - Name: CreateChangeSet
            ActionTypeId:
              Category: Deploy
              Owner: AWS
              Provider: CloudFormation
              Version: 1
            Configuration:
              ActionMode: CHANGE_SET_REPLACE
              RoleArn: !GetAtt CloudFormationExecutionRole.Arn
              StackName: !Sub '${ServiceName}'
              ChangeSetName: !Sub '${ServiceName}-ChangeSet'
              TemplatePath: BuiltZip::output.yaml
              Capabilities: CAPABILITY_IAM
            InputArtifacts:
            - Name: BuiltZip
            RunOrder: 1
          - Name: ExecuteChangeSet
            ActionTypeId:
              Category: Deploy
              Owner: AWS
              Provider: CloudFormation
              Version: 1
            Configuration:
              ActionMode: CHANGE_SET_EXECUTE
              RoleArn: !GetAtt CloudFormationExecutionRole.Arn
              StackName: !Sub '${ServiceName}'
              ChangeSetName: !Sub '${ServiceName}-ChangeSet'
            OutputArtifacts:
            - Name: !Sub '${ServiceName}ChangeSet'
            RunOrder: 2