Setup.yaml

# Copyright 2019 Amazon.com, Inc. and its affiliates. All Rights Reserved.
#
# Licensed under the Amazon Software License (the 'License').
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
#   http://aws.amazon.com/asl/
#
# or in the 'license' file accompanying this file. This file is distributed
# on an 'AS IS' BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.

AWSTemplateFormatVersion: "2010-09-09"
Description: "Create Lambda Function"

Parameters:
  MyGitToken:
    Type:  String
    NoEcho: true
    Description: Your Git Personal Access Token


Resources:

  Secret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: MyGitToken
      SecretString: !Ref MyGitToken


#----------------------------------------------------------------------#
# Role for lambda execution
#----------------------------------------------------------------------#
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: LambdaRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambdaFullAccess
        - arn:aws:iam::aws:policy/AWSCloudFormationFullAccess
        - arn:aws:iam::aws:policy/AWSCodePipelineFullAccess
        - arn:aws:iam::aws:policy/SecretsManagerReadWrite
      Path: /


#----------------------------------------------------------------------#
# Role for Pipeline Execution
#----------------------------------------------------------------------#
  CodePipelineRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CodePipelineRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCodePipelineFullAccess
        - arn:aws:iam::aws:policy/AWSCodeCommitFullAccess
        - arn:aws:iam::aws:policy/AWSCodeBuildDeveloperAccess
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
            Action:
              - 'sts:AssumeRole'



#----------------------------------------------------------------------#
# Role for CodeBuild Execution
#----------------------------------------------------------------------#
  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: CodeBuildRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action:
              - 'sts:AssumeRole'


#----------------------------------------------------------------------#
# S3 Bucket to store template
#----------------------------------------------------------------------#
  TemplateBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Sub ${AWS::AccountId}-cfn

  TemplateBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref TemplateBucket
      PolicyDocument:
        Statement:
          -
            Action:
                - s3:*
            Effect: Allow
            Resource:
              - !Sub arn:aws:s3:::${TemplateBucket}
              - !Sub arn:aws:s3:::${TemplateBucket}/*
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:root



#----------------------------------------------------------------------#
# Lambda for Stack Creation
#----------------------------------------------------------------------#
  CreatePipeline:
    DependsOn: LambdaRole
    Type: "AWS::Lambda::Function"
    Properties:
      FunctionName: CreatePipeline
      Handler: "index.lambda_handler"
      Role: !GetAtt LambdaRole.Arn
      Runtime: "python3.6"
      Timeout: 25
      Code:
        ZipFile: |
          import boto3
          import json
          import os
          def lambda_handler(event, context):
              print('## ENVIRONMENT VARIABLES')
              print(os.environ)
              print('## EVENT')
              print(event)
              data = json.loads(event['body'])
              EventType = event['headers']['X-GitHub-Event']
              NewBranch = data['ref']
              RefType = data['ref_type']
              Account = (data['repository']['owner']['login'])
              RepositoryName = (data['repository']['name'])
              AccountID = boto3.client('sts').get_caller_identity()['Account']
              print('## VARIABLES')
              print('EventType:', EventType)
              print('NewBranch:', NewBranch)
              print('RefType:', RefType)
              print('Account:', Account)
              print('RepositoryName:', RepositoryName)
              print('AccountID:', AccountID)
              if NewBranch == "master":
                quit()
              if EventType == "create":
                  cf_client = boto3.client('cloudformation')
                  cf_client.create_stack(
                      StackName= f'Pipeline-{RepositoryName}-{NewBranch}',
                      TemplateURL= f'https://s3.amazonaws.com/{AccountID}-cfn/TemplatePipeline.yaml',
                      Parameters=[
                          {
                              'ParameterKey': 'RepositoryName',
                              'ParameterValue': RepositoryName,
                              'UsePreviousValue': False
                          },
                          {
                              'ParameterKey': 'BranchName',
                              'ParameterValue': NewBranch,
                              'UsePreviousValue': False
                          }
                      ],
                      OnFailure='ROLLBACK',
                      Capabilities=['CAPABILITY_NAMED_IAM']
                  )
              else:
                  cf_client = boto3.client('cloudformation')
                  cf_client.delete_stack(
                      StackName= f'Pipeline-{RepositoryName}-{NewBranch}'
                  )

  RestApi:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Description: API used by the AWS CodePipeline integration with GitHub
      EndpointConfiguration:
        Types:
          - REGIONAL
      Name: CodePipeline-GitHub-Integration

  RestApiMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: NONE
      HttpMethod: POST
      Integration:
        IntegrationHttpMethod: POST
        Type: AWS_PROXY
        Uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${CreatePipeline.Arn}/invocations'
      ResourceId: !GetAtt
        - RestApi
        - RootResourceId
      RestApiId: !Ref RestApi

  RestApiDeployment:
    Type: AWS::ApiGateway::Deployment
    DependsOn: RestApiMethod
    Properties:
      Description: Stage Deployment
      RestApiId: !Ref RestApi
      StageName: prod

  LambdaPermissionAPIGw:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref CreatePipeline
      Principal: apigateway.amazonaws.com

Outputs:
  Endpoint:
    Value: !Sub "https://${RestApi}.execute-api.${AWS::Region}.amazonaws.com/prod/"
  S3Bucket:
    Value: !Ref TemplateBucket