bootstrap.stack.yml

AWSTemplateFormatVersion: 2010-09-09
Description: Serverless Stack CI/CD - Boostrap

Parameters:
  TLD:
    Type: String
    Description: TLD name needed by Route53 to perform DNS (example.com)
  Domain:
    Type: String
    Description: Domain name for your website (example.com)

  GitHubOwner:
    Description: The name of the GitHub repository owner
    Type: String
  GitHubToken:
    Type: String
    Description: GitHub repository OAuth token
    NoEcho: true
  GitHubRepo:
    Type: String
    Description: GitHub repository name

Resources:

  #
  # Bucket used by the pipelines to store artifacts.
  #
  PipelinesBucket:
    Description: The artifact bucket required for inter-stage data exchange
    Type: AWS::S3::Bucket

  #
  # IAM Role needed by the pipelines
  #
  CodePipelineRole:
    Description: The role CodePipeline will assume during pipeline execution
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
            Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
            Action: sts:AssumeRole

  CodePipelinePolicy:
    Description: Policy for the CodePipeline Role
    DependsOn: CodePipelineRole
    Type: AWS::IAM::Policy
    Properties:
      PolicyName:
        Fn::Join:
          - ''
          - - Ref: AWS::StackName
            - '-pipeline-policy'
      Roles:
        - !Ref CodePipelineRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
              - s3:*
            Effect: Allow
            Resource:
              - !GetAtt PipelinesBucket.Arn
              - !Join ["", [!GetAtt PipelinesBucket.Arn, "*"]]
          - Action:
              - cloudformation:*
            Effect: Allow
            Resource:
              - !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/*
          - Action:
              - codepipeline:*
            Effect: Allow
            Resource:
              - !Sub arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:*
          - Action:
              - codebuild:StartBuild
              - codebuild:BatchGetBuilds
              - codebuild:StopBuild
            Effect: Allow
            Resource:
              - '*'
          - Action:
              - iam:PassRole
            Effect: Allow
            Resource:
              - !GetAtt CloudFormationRole.Arn

  #
  # IAM Role needed by cloudformation
  #
  CloudFormationRole:
    Description: The role cloudformation will assume during pipeline execution
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
            Effect: Allow
            Principal:
              Service:
                - cloudformation.amazonaws.com
            Action: sts:AssumeRole
  CloudFormationPolicy:
    Description: Policy for the cloudformation execution Role
    DependsOn: CloudFormationRole
    Type: AWS::IAM::Policy
    Properties:
      PolicyName:
        Fn::Join:
          - ''
          - - Ref: AWS::StackName
            - '-cloudformation-policy'
      Roles:
        - !Ref CloudFormationRole
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - '*'
            Resource:
              - '*'

  #
  # IAM role needed by our CodeBuild
  #
  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - codebuild.amazonaws.com
  CodeBuildPolicy:
    Type: AWS::IAM::Policy
    Description: Policy for the codebuild execution
    DependsOn: CodeBuildRole
    Properties:
      PolicyName:
        Fn::Join:
          - ''
          - - Ref: AWS::StackName
            - '-codebuild-policy'
      Roles:
        - !Ref CodeBuildRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - '*'
            Resource:
              - '*'

  #
  # Code Build project.
  # - Package the Lambda Functions
  #
  APICodeBuildProd:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/nodejs:6.3.1
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: Bucket
            Value: !Ref PipelinesBucket
      Name: 'api-code-build-prod'
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Source:
        Type: CODEPIPELINE
        BuildSpec: stacks/api/buildspec.yml
      TimeoutInMinutes: 5 # must be between 5 minutes and 8 hours
  APICodeBuildSandbox:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/nodejs:6.3.1
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: Bucket
            Value: !Ref PipelinesBucket
      Name: 'api-code-build-sandbox'
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Source:
        Type: CODEPIPELINE
        BuildSpec: stacks/api/buildspec.yml
      TimeoutInMinutes: 5 # must be between 5 minutes and 8 hours

  #
  # Code Build project.
  # - Package the Lambda Functions
  #
  TasksCodeBuildProd:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/nodejs:6.3.1
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: Bucket
            Value: !Ref PipelinesBucket
      Name: 'tasks-code-build-prod'
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Source:
        Type: CODEPIPELINE
        BuildSpec: stacks/tasks/buildspec.yml
      TimeoutInMinutes: 5 # must be between 5 minutes and 8 hours
  TasksCodeBuildSandbox:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/nodejs:6.3.1
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: Bucket
            Value: !Ref PipelinesBucket
      Name: 'tasks-code-build-sandbox'
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Source:
        Type: CODEPIPELINE
        BuildSpec: stacks/tasks/buildspec.yml
      TimeoutInMinutes: 5 # must be between 5 minutes and 8 hours

  #
  # Code Build project.
  # - Deploy the UI
  #
  UICodeBuildProd:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/nodejs:6.3.1
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: StackName
            Value: !Sub "${AWS::StackName}-ui-prod"
      Name: 'ui-code-build-prod'
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Source:
        Type: CODEPIPELINE
        BuildSpec: stacks/ui/buildspec.yml
      TimeoutInMinutes: 5 # must be between 5 minutes and 8 hours
  UICodeBuildSandbox:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/nodejs:6.3.1
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: StackName
            Value: !Sub "${AWS::StackName}-ui-sandbox"
      Name: 'ui-code-build-sandbox'
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Source:
        Type: CODEPIPELINE
        BuildSpec: stacks/ui/buildspec.yml
      TimeoutInMinutes: 5 # must be between 5 minutes and 8 hours

  #
  # Pipelines that create/update the cloudformation stacks within the project
  # Prod environment.
  #
  PipelineProd:
    Description: Serverless Stack - Prod Pipeline
    Type: AWS::CodePipeline::Pipeline
    DependsOn:
      - CodePipelinePolicy
      - CloudFormationPolicy
      - APICodeBuildProd
      - UICodeBuildProd
    Properties:
      RestartExecutionOnUpdate: True
      RoleArn: !GetAtt CodePipelineRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref PipelinesBucket
      Stages:
        - Name: Source
          Actions:
            - Name: CloneRepository
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: 1
                Provider: GitHub
              OutputArtifacts:
                - Name: GitSource
              Configuration:
                Owner: !Ref GitHubOwner
                Branch: 'master'
                Repo: !Ref GitHubRepo
                OAuthToken: !Ref GitHubToken
              RunOrder: 1
        - Name: TasksPackage
          Actions:
            - Name: Package
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              Configuration:
                ProjectName: !Ref TasksCodeBuildProd
              InputArtifacts:
                - Name: GitSource
              OutputArtifacts:
                - Name: TasksOutput
              RunOrder: 1
        - Name: TasksStack
          Actions:
            - Name: CreateChangeSet
              InputArtifacts:
                - Name: TasksOutput
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                TemplatePath: "TasksOutput::tasks.stack.output.yml"
                ActionMode: CHANGE_SET_REPLACE
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt CloudFormationRole.Arn
                StackName: !Sub "${AWS::StackName}-tasks-prod"
                ChangeSetName: !Sub "${AWS::StackName}-tasks-prod-cs"
              RunOrder: 1
            - Name: ExecuteChangeSet
              InputArtifacts:
                - Name: TasksOutput
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt CloudFormationRole.Arn
                StackName: !Sub "${AWS::StackName}-tasks-prod"
                ChangeSetName: !Sub "${AWS::StackName}-tasks-prod-cs"
              RunOrder: 2
        - Name: ApiPackage
          Actions:
            - Name: Package
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              Configuration:
                ProjectName: !Ref APICodeBuildProd
              InputArtifacts:
                - Name: GitSource
              OutputArtifacts:
                - Name: PackageOutput
              RunOrder: 1
        - Name: ApiStack
          Actions:
            - Name: CreateChangeSet
              InputArtifacts:
                - Name: PackageOutput
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                TemplatePath: "PackageOutput::api.stack.output.yml"
                ActionMode: CHANGE_SET_REPLACE
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt CloudFormationRole.Arn
                StackName: !Sub "${AWS::StackName}-api-prod"
                ChangeSetName: !Sub "${AWS::StackName}-api-prod-cs"
                ParameterOverrides: !Sub |
                  {
                    "Stage": "prod",
                    "TasksStack": "${AWS::StackName}-tasks-prod",
                    "Domain": "api.${Domain}",
                    "TLD" : "${TLD}"
                  }
              RunOrder: 1
            - Name: ExecuteChangeSet
              InputArtifacts:
                - Name: PackageOutput
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt CloudFormationRole.Arn
                StackName: !Sub "${AWS::StackName}-api-prod"
                ChangeSetName: !Sub "${AWS::StackName}-api-prod-cs"
              RunOrder: 2
        - Name: UI
          Actions:
            - Name: Stack
              InputArtifacts:
                - Name: GitSource
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                TemplatePath: "GitSource::stacks/ui/ui.stack.yml"
                ActionMode: CREATE_UPDATE
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt CloudFormationRole.Arn
                StackName: !Sub "${AWS::StackName}-ui-prod"
                ParameterOverrides: !Sub |
                  {
                    "Domain": "${Domain}",
                    "TLD" : "${TLD}"
                  }
              RunOrder: 1
            - Name: Deploy
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              Configuration:
                ProjectName: !Ref UICodeBuildProd
              InputArtifacts:
                - Name: GitSource
              RunOrder: 2

  #
  # Pipelines that create/update the cloudformation stacks within the project
  # Sandbox environment.
  #
  PipelineSandbox:
    Description: Serverless Stack - Sandbox Pipeline
    Type: AWS::CodePipeline::Pipeline
    DependsOn:
      - CodePipelinePolicy
      - CloudFormationPolicy
      - APICodeBuildSandbox
      - UICodeBuildSandbox
    Properties:
      RestartExecutionOnUpdate: True
      RoleArn: !GetAtt CodePipelineRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref PipelinesBucket
      Stages:
        - Name: Source
          Actions:
            - Name: CloneRepository
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: 1
                Provider: GitHub
              OutputArtifacts:
                - Name: GitSource
              Configuration:
                Owner: !Ref GitHubOwner
                Branch: 'develop'
                Repo: !Ref GitHubRepo
                OAuthToken: !Ref GitHubToken
              RunOrder: 1
        - Name: TasksPackage
          Actions:
            - Name: Package
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              Configuration:
                ProjectName: !Ref TasksCodeBuildSandbox
              InputArtifacts:
                - Name: GitSource
              OutputArtifacts:
                - Name: TasksOutput
              RunOrder: 1
        - Name: TasksStack
          Actions:
            - Name: CreateChangeSet
              InputArtifacts:
                - Name: TasksOutput
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                TemplatePath: "TasksOutput::tasks.stack.output.yml"
                ActionMode: CHANGE_SET_REPLACE
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt CloudFormationRole.Arn
                StackName: !Sub "${AWS::StackName}-tasks-sandbox"
                ChangeSetName: !Sub "${AWS::StackName}-tasks-sandbox-cs"
              RunOrder: 1
            - Name: ExecuteChangeSet
              InputArtifacts:
                - Name: TasksOutput
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt CloudFormationRole.Arn
                StackName: !Sub "${AWS::StackName}-tasks-sandbox"
                ChangeSetName: !Sub "${AWS::StackName}-tasks-sandbox-cs"
              RunOrder: 2
        - Name: ApiPackage
          Actions:
            - Name: Package
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              Configuration:
                ProjectName: !Ref APICodeBuildSandbox
              InputArtifacts:
                - Name: GitSource
              OutputArtifacts:
                - Name: PackageOutput
              RunOrder: 1
        - Name: ApiStack
          Actions:
            - Name: CreateChangeSet
              InputArtifacts:
                - Name: PackageOutput
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                TemplatePath: "PackageOutput::api.stack.output.yml"
                ActionMode: CHANGE_SET_REPLACE
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt CloudFormationRole.Arn
                StackName: !Sub "${AWS::StackName}-api-sandbox"
                ChangeSetName: !Sub "${AWS::StackName}-api-sandbox-cs"
                ParameterOverrides: !Sub |
                  {
                    "Stage": "sandbox",
                    "TasksStack": "${AWS::StackName}-tasks-sandbox",
                    "Domain": "dev.api.${Domain}",
                    "TLD" : "${TLD}"
                  }
              RunOrder: 1
            - Name: ExecuteChangeSet
              InputArtifacts:
                - Name: PackageOutput
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt CloudFormationRole.Arn
                StackName: !Sub "${AWS::StackName}-api-sandbox"
                ChangeSetName: !Sub "${AWS::StackName}-api-sandbox-cs"
              RunOrder: 2
        - Name: UI
          Actions:
            - Name: Stack
              InputArtifacts:
                - Name: GitSource
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: CloudFormation
              Configuration:
                TemplatePath: "GitSource::stacks/ui/ui.stack.yml"
                ActionMode: CREATE_UPDATE
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt CloudFormationRole.Arn
                StackName: !Sub "${AWS::StackName}-ui-sandbox"
                ParameterOverrides: !Sub |
                  {
                    "Domain": "dev.${Domain}",
                    "TLD" : "${TLD}"
                  }
              RunOrder: 1
            - Name: Deploy
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1
              Configuration:
                ProjectName: !Ref UICodeBuildSandbox
              InputArtifacts:
                - Name: GitSource
              RunOrder: 2