Pipeline_GitHub.json

{
    "AWSTemplateFormatVersion" : "2010-09-09",

    "Description" : "AWS CloudFormation Sample template to create a Codepipline to build and push docker images to ECR",

    "Parameters": {
        "BranchName": {
            "Description": "GitHub branch name",
            "Type": "String",
            "Default": "master"
        },
        "RepositoryName": {
            "Description": "GitHub repository name",
            "Type": "String",
            "Default": "myrepo"
        },
        "ECRRepoName": {
            "Description": "Name of ECR to be created",
            "Type": "String"
        },
        "GitHubOAthToken": {
            "Description": "GitHub OAuth Token",
            "Type": "String"
        },
        "RepoOwner": {
            "Description": "GitHub Repo Owner",
            "Type": "String"
        }
    },
    "Resources": {
        "CodePipelineArtifactStoreBucket": {
            "Type": "AWS::S3::Bucket",
            "Properties": {
                "BucketEncryption": {
                    "ServerSideEncryptionConfiguration": [
                        {
                            "ServerSideEncryptionByDefault": {
                                "SSEAlgorithm": "aws:kms",
                                "KMSMasterKeyID": "aws/s3"
                            }
                        }
                    ]
                },
                "VersioningConfiguration": {
                    "Status" : "Enabled"
                },
            }    
        },
        "CodePipelineArtifactStoreBucketPolicy": {
            "Type": "AWS::S3::BucketPolicy",
            "Properties": {
                "Bucket": {
                    "Ref": "CodePipelineArtifactStoreBucket"
                },
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Sid": "DenyUnEncryptedObjectUploads",
                            "Effect": "Deny",
                            "Principal": "*",
                            "Action": "s3:PutObject",
                            "Resource": {
                                "Fn::Join": [
                                    "",
                                    [
                                        {
                                            "Fn::GetAtt": [
                                                "CodePipelineArtifactStoreBucket",
                                                "Arn"
                                            ]
                                        },
                                        "/*"
                                    ]
                                ]
                            },
                            "Condition": {
                                "StringNotEquals": {
                                    "s3:x-amz-server-side-encryption": "aws:kms"
                                }
                            }
                        },
                        {
                            "Sid": "DenyInsecureConnections",
                            "Effect": "Deny",
                            "Principal": "*",
                            "Action": "s3:*",
                            "Resource": {
                                "Fn::Join": [
                                    "",
                                    [
                                        {
                                            "Fn::GetAtt": [
                                                "CodePipelineArtifactStoreBucket",
                                                "Arn"
                                            ]
                                        },
                                        "/*"
                                    ]
                                ]
                            },
                            "Condition": {
                                "Bool": {
                                    "aws:SecureTransport": false
                                }
                            }
                        }
                    ]
                }
            }
        },
        "ECRRepo": {
            "Type": "AWS::ECR::Repository",
            "Properties" : {
                "EncryptionConfiguration" : {
                    "EncryptionType" : "KMS"
                  },
                "ImageScanningConfiguration" : {
                    "ScanOnPush" : true
                  },
                "ImageTagMutability" : "MUTABLE",
                "RepositoryName" : {
                    "Ref": "ECRRepoName"
                }
              }
        },
        "AmazonCloudWatchEventRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": [
                                    "events.amazonaws.com"
                                ]
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "cwe-pipeline-execution",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": "codepipeline:StartPipelineExecution",
                                    "Resource": {
                                        "Fn::Join": [
                                            "",
                                            [
                                                "arn:aws:codepipeline:",
                                                {
                                                    "Ref": "AWS::Region"
                                                },
                                                ":",
                                                {
                                                    "Ref": "AWS::AccountId"
                                                },
                                                ":",
                                                {
                                                    "Ref": "AppPipeline"
                                                }
                                            ]
                                        ]
                                    }
                                }
                            ]
                        }
                    }
                ]
            }
        },
        
        "CodeBuildServiceRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": [
                                    "codebuild.amazonaws.com"
                                ]
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "code-build-execution",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "ecr:BatchCheckLayerAvailability",
                                        "ecr:CompleteLayerUpload",
                                        "ecr:GetAuthorizationToken",
                                        "ecr:InitiateLayerUpload",
                                        "ecr:PutImage",
                                        "ecr:UploadLayerPart",
                                        "logs:*",
                                        "s3:*"
                                      ],
                                      "Resource": "*"
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "CodeBuild": {
            "Type" : "AWS::CodeBuild::Project",
            "Properties" : {
                "Artifacts" : {
                    "Type": "NO_ARTIFACTS"
                },
                "Description" : "Code Build Project to build and push artifacts to ECR",
                "Environment" : {
                    "ComputeType" : "BUILD_GENERAL1_SMALL",
                    "EnvironmentVariables" : [ {
                        "Name": "AWS_DEFAULT_REGION",
                        "Value": { "Ref" : "AWS::Region" }
                      },
                      {
                        "Name": "AWS_ACCOUNT_ID",
                        "Value": { "Ref" : "AWS::AccountId" } 
                      },
                      {
                        "Name": "IMAGE_REPO_NAME",
                        "Value": {"Ref": "ECRRepoName"}
                      },
                      {
                        "Name": "IMAGE_TAG",
                        "Value": "latest"
                      } ],
                    "Image" : "aws/codebuild/standard:4.0",
                    "PrivilegedMode" : true ,
                    "Type" : "LINUX_CONTAINER"
                  },
                "ServiceRole" : {"Ref": "CodeBuildServiceRole" },
                "Source" : {
                    "Type" : "GITHUB",
                    "Location": { "Fn::Join" : [ ",", [ "https://github.com/",{"Ref": "RepoOwner"}, "/",{ "Ref": "RepositoryName"} ] ] } 
                  }
                }
        },

        "AppPipeline": {
            "Type": "AWS::CodePipeline::Pipeline",
            "Properties": {
                "Name": "Apprunner-events-pipeline",
                "RoleArn": {
                    "Fn::GetAtt": [
                        "CodePipelineServiceRole",
                        "Arn"
                    ]
                },
                "Stages": [
                    {
                        "Name": "Source",
                        "Actions": [
                            {
                                "Name": "SourceAction",
                                "ActionTypeId": {
                                    "Category": "Source",
                                    "Owner": "ThirdParty",
                                    "Version": 1,
                                    "Provider": "GitHub"
                                },
                                "OutputArtifacts": [
                                    {
                                        "Name": "SourceOutput"
                                    }
                                ],
                                "Configuration": {
                                    "Branch": {
                                        "Ref": "BranchName"
                                    },
                                    "Repo": {
                                        "Ref": "RepositoryName"
                                    },
                                    "OAuthToken": {
                                        "Ref": "GitHubOAthToken"
                                    },
                                    "Owner": {
                                        "Ref": "RepoOwner"
                                    },
                                    "PollForSourceChanges": true
                                },
                                "RunOrder": 1
                            }
                        ]
                    },
                    {
                        "Name": "Build",
                        "Actions": [
                            {
                                "Name": "Build",
                                "InputArtifacts": [
                                    {
                                        "Name": "SourceOutput"
                                    }
                                ],
                                "ActionTypeId": {
                                    "Category": "Build",
                                    "Owner": "AWS",
                                    "Version": 1,
                                    "Provider": "CodeBuild"
                                },
                                "Configuration": {
                                    "ProjectName": {"Ref": "CodeBuild" }
                                },    
                                "RunOrder": 2
                            }
                        ]
                    }
                ],
                "ArtifactStore": {
                    "Type": "S3",
                    "Location": {
                        "Ref": "CodePipelineArtifactStoreBucket"
                    }
                }
                
            }
        },
        "CodePipelineServiceRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": [
                                    "codepipeline.amazonaws.com"
                                ]
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "AWS-CodePipeline-Service-3",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codedeploy:CreateDeployment",
                                        "codedeploy:GetApplicationRevision",
                                        "codedeploy:GetDeployment",
                                        "codedeploy:GetDeploymentConfig",
                                        "codedeploy:RegisterApplicationRevision"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "codebuild:BatchGetBuilds",
                                        "codebuild:StartBuild"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "devicefarm:ListProjects",
                                        "devicefarm:ListDevicePools",
                                        "devicefarm:GetRun",
                                        "devicefarm:GetUpload",
                                        "devicefarm:CreateUpload",
                                        "devicefarm:ScheduleRun"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "lambda:InvokeFunction",
                                        "lambda:ListFunctions"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "iam:PassRole"
                                    ],
                                    "Resource": "*"
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "elasticbeanstalk:*",
                                        "ec2:*",
                                        "elasticloadbalancing:*",
                                        "autoscaling:*",
                                        "cloudwatch:*",
                                        "s3:*",
                                        "sns:*",
                                        "cloudformation:*",
                                        "rds:*",
                                        "sqs:*",
                                        "ecs:*"
                                    ],
                                    "Resource": "*"
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "DDBTable": {
            "Type" : "AWS::DynamoDB::Table",
            "Properties" : {
                "AttributeDefinitions" : [ {
                    "AttributeName": "year",
                    "AttributeType": "N"
                },
                {
                    "AttributeName": "title",
                    "AttributeType": "S"
                } ],
                "BillingMode" : "PROVISIONED",
                "ContributorInsightsSpecification" : {
                    "Enabled" : true
                  },
                "KeySchema" : [ {
                    "AttributeName": "year",
                    "KeyType": "HASH"                  },
                {
                    "AttributeName": "title",
                    "KeyType": "RANGE"  
                } ],
                "ProvisionedThroughput" : {
                    "ReadCapacityUnits" : 10,
                    "WriteCapacityUnits" : 10
                  },
                "TableClass" : "STANDARD",
                "TableName" : "Movies"
              }
          }

    }
}