deployment-pipeline.cfn.yml

AWSTemplateFormatVersion: '2010-09-09'

Parameters:
  GitHubOAUTHTokenASMPath:
    Default: githuboauthtoken
    Description: GitHubServiceOAUTHToken Secret name
    Type: String
  OrgId:
    Type: String
    Description: AWS Organizations Id
    Default: ''
  RootOU:
    Type: String
    Description: AWS Organizations Root OU Id.
    Default: ''
  Prefix:
    Type: String
    MaxLength: 12
    ConstraintDescription: Prefix is limited to 12 alphanumeric characters
    Description: "Prefix carve AWS resources and stacknames with this"
    Default: ''
  UniqueId:
    Type: String
    Description: A unique id may be used instead of OrgId on buckets
    Default: ""

Resources:
  DeployBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${Prefix}carve-deploy-bucket-${AWS::AccountId}-${AWS::Region}"
      AccessControl: Private
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: 'AES256'
      LifecycleConfiguration:
        Rules:
          - Id: InfrequentAccessRule
            Status: Enabled
            Transitions:
              - TransitionInDays: 30
                StorageClass: STANDARD_IA

  TagsLambda:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${Prefix}carve-tags"
      Description: Generate tags file for carve core CFN deployment
      Handler: index.lambda_handler
      Role: !GetAtt CarvePipelineRole.Arn
      Runtime: python3.9
      Timeout: 20
      MemorySize: 128
      Code:
        ZipFile: !Sub |
          import boto3
          import json
          from boto3.session import Session
          from zipfile import ZipFile
          import os
          import shutil
          import uuid

          def evaluate(event):
              # Extract attributes passed in by CodePipeline
              job_id = event['CodePipeline.job']['id']
              job_data = event['CodePipeline.job']['data']
              user_params = job_data['actionConfiguration']['configuration']['UserParameters']
              credentials = job_data['artifactCredentials']
              output_artifact = job_data['outputArtifacts'][0]
              output_bucket = output_artifact['location']['s3Location']['bucketName']
              output_key = output_artifact['location']['s3Location']['objectKey']
              # Temporary credentials to access CodePipeline artifact in S3
              key_id = credentials['accessKeyId']
              key_secret = credentials['secretAccessKey']
              session_token = credentials['sessionToken']

              return (job_id, user_params, output_bucket, output_key, key_id, key_secret, session_token)

          def get_tags(stackid):
              '''
              generate formatted tag data for CFN from the applied tags on pipeline stack
              '''
              # stackid = event['CodePipeline.job']['data']['actionConfiguration']['configuration']['UserParameters']
              print(f"getting tags from pipeline stack: {stackid}")
              cfn = boto3.client('cloudformation', region_name='us-east-1')
              stack = cfn.describe_stacks(StackName=stackid)
              print(f"pipeline stack tags: {stack['Stacks'][0]['Tags']}")
              tags = {"Tags":{}}
              for tag in stack['Stacks'][0]['Tags']:
                  tags['Tags'][tag['Key']] = tag['Value']
              return tags

          def create_artifact(data):
              artifact_dir = '/tmp/output_artifacts/'+str(uuid.uuid4())
              artifact_file = artifact_dir+'/files/carve-tags.json'
              zipped_artifact_file = artifact_dir+'/artifact.zip'
              try:
                  shutil.rmtree(artifact_dir+'/files/')
              except Exception:
                  pass
              try:
                  os.remove(zipped_artifact_file)
              except Exception:
                  pass
              os.makedirs(artifact_dir+'/files/')
              with open(artifact_file, 'w') as outfile:
                  json.dump(data, outfile)
              with ZipFile(zipped_artifact_file, 'w') as zipped_artifact:
                  zipped_artifact.write(artifact_file, os.path.basename(artifact_file))

              return zipped_artifact_file


          def lambda_handler(event, context):
              code_pipeline = boto3.client('codepipeline')
              try:
                  job_id, user_params, output_bucket, output_key, key_id, key_secret, session_token = evaluate(event)
                  session = Session(aws_access_key_id=key_id, aws_secret_access_key=key_secret, aws_session_token=session_token)
                  s3client = session.client('s3')
                  tags = get_tags(user_params)
                  zipped_artifact_file = create_artifact(tags)
                  s3client.upload_file(zipped_artifact_file, output_bucket, output_key, ExtraArgs={"ServerSideEncryption": "AES256"})
                  # Tell CodePipeline we succeeded
                  code_pipeline.put_job_success_result(jobId=job_id)
              except Exception as e:
                  print(f"ERROR: {e}")
                  # Tell CodePipeline we failed
                  code_pipeline.put_job_failure_result(jobId=job_id, failureDetails={'message': e, 'type': 'JobFailed'})
              return "complete"


  IMAGETAG:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/${Prefix}carve-resources/ecr-tag"
      Type: String
      Value: "0.0"
      Description: Version of carve image in ECR

  ECR: 
    Type: AWS::ECR::Repository
    Properties: 
      RepositoryName: !Sub "${Prefix}carve-repository"
      EncryptionConfiguration:
        EncryptionType: AES256
      ImageScanningConfiguration: 
        ScanOnPush: "true"
      LifecyclePolicy:
        LifecyclePolicyText: |
          {
            "rules": [
            {
              "rulePriority": 1,
              "description": "Only keep 4 images",
              "selection": {
                "tagStatus": "any",
                "countType": "imageCountMoreThan",
                "countNumber": 4
              },
              "action": { "type": "expire" }
            }]
          }
      RepositoryPolicyText: 
        Version: "2012-10-17"
        Statement: 
          - 
            Sid: PipelineControl
            Effect: Allow
            Principal: 
              AWS: !GetAtt 'CarvePipelineRole.Arn'
            Action: 
              - "ecr:*"
          - 
            Sid: RootControl
            Effect: Allow
            Principal: 
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action: 
              - "ecr:*"
          # -
          #   Sid: "CrossAccountPermission"
          #   Effect: "Allow"
          #   Action: 
          #     - "ecr:BatchGetImage"
          #     - "ecr:GetDownloadUrlForLayer"
          #   Principal: 
          #     AWS: "*"
          #   Condition:
          #     StringEquals:
          #       aws:PrincipalOrgID: !Ref OrgId

  CarvePipelineRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${Prefix}carve-deploy-pipeline
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
                - cloudformation.amazonaws.com
                - lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: CodePipelineServiceRole
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: CloudWatchLogsPolicy
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - logs:PutRetentionPolicy
                  - logs:DeleteLogGroup
                Resource:
                  - '*'
              - Effect: Allow
                Action:
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds
                Resource:
                  - !Sub 'arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/CarveCodeBuild'
              - Effect: Allow
                Action:
                  - '*'
                Resource:
                  - '*'

  CarveDeploymentPipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Name: CarveDeploymentPipeline
      RoleArn: !GetAtt 'CarvePipelineRole.Arn'
      RestartExecutionOnUpdate: true
      ArtifactStore:
        Location: !Ref 'DeployBucket'
        Type: S3
      Stages:
        - Name: CarveSource
          Actions:
            - Name: SourceAction
              Namespace: github_vars
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Provider: GitHub
                Version: 1
              OutputArtifacts:
                - Name: GithubRepo
              Region: !Ref 'AWS::Region'
              Configuration:
                Owner: SPSCommerce
                Repo: carve
                Branch: dev
                OAuthToken: !Sub '{{resolve:secretsmanager:${GitHubOAUTHTokenASMPath}:SecretString:token}}'

        - Name: UpdatePipeline
          Actions:
            - Name: update-pipeline
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              Configuration:
                ChangeSetName: pipeline-changeset
                ActionMode: CREATE_UPDATE
                Capabilities: CAPABILITY_NAMED_IAM,CAPABILITY_AUTO_EXPAND
                RoleArn: !GetAtt 'CarvePipelineRole.Arn'
                StackName: !Ref "AWS::StackName"
                TemplatePath: GithubRepo::deployment/deployment-pipeline.cfn.yml
                ParameterOverrides: !Sub |
                  {
                    "GitHubOAUTHTokenASMPath": "${GitHubOAUTHTokenASMPath}", 
                    "OrgId": "${OrgId}", 
                    "RootOU": "${RootOU}", 
                    "Prefix": "${Prefix}", 
                    "UniqueId": "${UniqueId}"
                  }
              OutputArtifacts: []
              InputArtifacts:
                - Name: GithubRepo

        - Name: PackageLambda
          Actions:
            - Name: carve-lambda-packaging
              Namespace: codebuild_vars
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              InputArtifacts:
                - Name: GithubRepo
              Region: !Ref 'AWS::Region'
              Configuration:
                ProjectName: !Ref 'CarveCodeBuild'
                EnvironmentVariables: '[{"name":"GITSHA","value":"#{github_vars.CommitId}","type":"PLAINTEXT"}]'

        - Name: CarveCoreDeploy
          Actions:
            - Name: generate-tags-file
              ActionTypeId:
                Category: Invoke
                Owner: AWS
                Provider: Lambda
                Version: '1'
              RunOrder: 1
              Configuration:
                FunctionName: !Ref "TagsLambda"
                UserParameters: !Ref "AWS::StackId"
              OutputArtifacts:
                - Name: TagData
              InputArtifacts: []
              Region: !Ref 'AWS::Region'

            - Name: carve-core-stack
              RunOrder: 2
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              InputArtifacts:
                - Name: GithubRepo
                - Name: TagData
              Configuration:
                ChangeSetName: pipeline-changeset
                ActionMode: CREATE_UPDATE
                Capabilities: CAPABILITY_NAMED_IAM,CAPABILITY_AUTO_EXPAND
                RoleArn: !GetAtt 'CarvePipelineRole.Arn'
                StackName: !Sub '${Prefix}carve-core'
                TemplatePath: GithubRepo::deployment/templates/carve-core.cfn.yml
                TemplateConfiguration: TagData::carve-tags.json
                ParameterOverrides: !Sub |
                  {
                    "GITSHA":"#{github_vars.CommitId}",
                    "Prefix":"${Prefix}",
                    "OrgId":"${OrgId}",
                    "UniqueId":"${UniqueId}",
                    "CodeBucket":"${DeployBucket}",
                    "IMAGETAG":"#{codebuild_vars.TAG}",
                    "ECR":"${ECR}"
                  }
              OutputArtifacts: []
                                
        - Name: PrepManagedDeployments
          Actions:

            - Name: update-s3-notification
              ActionTypeId:
                Category: Invoke
                Owner: AWS
                Provider: Lambda
                Version: '1'
              RunOrder: 1
              Configuration:
                FunctionName: !Sub "${Prefix}carve-core-deploy_trigger"
                UserParameters: BucketNotification
              OutputArtifacts: []
              InputArtifacts: []
              Region: !Ref 'AWS::Region'


  CarveCodeBuild:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Name: CarveCodeBuild
      ServiceRole: !GetAtt 'CarveCodeBuildRole.Arn'
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/amazonlinux2-x86_64-standard:3.0
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: DEPLOYMENT_BUCKET
            Value: !Ref 'DeployBucket'
          - Name: GIT_TOKEN
            Value: !Ref 'GitHubOAUTHTokenASMPath'
          - Name: IMAGETAG
            Value: !Ref 'IMAGETAG'
          - Name: ECR
            Value: !Ref ECR
          - Name: AWS_ACCOUNT
            Value: !Ref 'AWS::AccountId'
      Source:
        Type: CODEPIPELINE
        BuildSpec: deployment/templates/buildspec.yml
      TimeoutInMinutes: 5
      Tags:
        - Key: GitSHA
          Value: '0'

  CarveCodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${Prefix}carve-deploy-codebuild
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: CodeBuildServiceRoleV2
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: CloudWatchLogsPolicy
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - '*'
              - Sid: DeployPolicy
                Effect: Allow
                Action:
                  - ssm:*
                  - secretsmanager:*
                  - kms:Decrypt
                  - ecr:GetAuthorizationToken
                Resource:
                  - '*'
              - Sid: S3Policy
                Effect: Allow
                Action:
                  - s3:*
                Resource:
                  - !Sub "arn:aws:s3:::${DeployBucket}"
                  - !Sub "arn:aws:s3:::${DeployBucket}/*"
              - Sid: iampolicy
                Effect: Allow
                Action:
                  - iam:PassRole
                Resource:
                  - '*'
              - Sid: ecrpolicy
                Effect: Allow
                Action:
                  - ecr:*
                Resource:
                  - !GetAtt ECR.Arn