template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  Release Machine

  SAM Template for release machine

Resources:
  ReleaseStateMachine:
    Type: AWS::Serverless::StateMachine # More info about State Machine Resource: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-statemachine.html
    Properties:
      DefinitionUri: statemachine/release_machine.asl.json
      DefinitionSubstitutions:
        CheckManifestFunctionArn: !GetAtt CheckManifestFunction.Arn
        RunPipelineFunctionArn: !GetAtt RunPipelineFunction.Arn
        CheckPipelinesFunctionArn: !GetAtt CheckPipelinesFunction.Arn
        DDBPutItem: !Sub arn:${AWS::Partition}:states:::dynamodb:putItem
        DDBUpdatetem: !Sub arn:${AWS::Partition}:states:::dynamodb:updateItem
        DDBTable: !Ref ReleasesTable
      Policies: # Find out more about SAM policy templates: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-policy-templates.html
        - LambdaInvokePolicy:
            FunctionName: !Ref CheckManifestFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref RunPipelineFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref CheckPipelinesFunction
        - DynamoDBWritePolicy:
            TableName: !Ref ReleasesTable
        - DynamoDBWritePolicy:
            TableName: !Ref ExecutionsTable

      Events:
        ApiEventTrigger:
          Type: Api
          Properties:
            Method: post
            Path: /
        ReleaseTrigger:
          Type: CloudWatchEvent
          Properties:
            EventBusName: default
            Pattern:
              source:
                - aws.s3
              detail-type:
                - AWS API Call via CloudTrail
              detail:
                eventSource:
                  - s3.amazonaws.com
                eventName:
                  - PutObject
                requestParameters:
                  bucketName:
                    - !Ref ReleaseBucket
      Tags:
        CreatedBy: 'release-machine'

  ReleaseBucket:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled
      Tags:
        - Key: 'CreatedBy'
          Value: 'release-machine'

  CheckManifestFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html
    Properties:
      CodeUri: functions/check-manifest/
      Handler: app.lambdaHandler
      Runtime: nodejs10.x
      Tracing: Active
      Environment:
        Variables:
          releasesTable: !Ref ReleasesTable
      Policies:
        - S3ReadPolicy:
            BucketName: !Ref ReleaseBucket
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - 'dynamodb:GetItem'
                - 'dynamodb:PutItem'
              Resource:
                'Fn::Join':
                  - ''
                  - - 'arn:aws:dynamodb:'
                    - Ref: 'AWS::Region'
                    - ':'
                    - Ref: 'AWS::AccountId'
                    - ':table/'
                    - Ref: ReleasesTable
      Tags:
        CreatedBy: 'release-machine'

  RunPipelineFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/pipeline-runner/
      Handler: app.lambdaHandler
      Runtime: nodejs10.x
      Tracing: Active
      Environment:
        Variables:
          releasesTable: !Ref ReleasesTable
          executionsTable: !Ref ExecutionsTable
      Policies:
        - Statement:
            - Sid: CodePipelinePermissions
              Effect: Allow
              Action:
                - codepipeline:StartPipelineExecution
                - codepipeline:StopPipelineExecution
                - codepipeline:GetPipelineState
                - codepipeline:GetPipelineExecution
                - codepipeline:ListPipelineExecutions
              Resource: '*'
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - 'dynamodb:GetItem'
                - 'dynamodb:PutItem'
              Resource:
                'Fn::Join':
                  - ''
                  - - 'arn:aws:dynamodb:'
                    - Ref: 'AWS::Region'
                    - ':'
                    - Ref: 'AWS::AccountId'
                    - ':table/'
                    - Ref: ExecutionsTable
      Tags:
        CreatedBy: 'release-machine'

  CheckPipelinesFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/check-pipelines/
      Handler: app.lambdaHandler
      Runtime: nodejs10.x
      Tracing: Active
      Environment:
        Variables:
          releasesTable: !Ref ReleasesTable
          executionsTable: !Ref ExecutionsTable
      Policies:
        - Statement:
            - Sid: CodePipelinePermissions
              Effect: Allow
              Action:
                - codepipeline:StartPipelineExecution
                - codepipeline:StopPipelineExecution
                - codepipeline:GetPipelineState
                - codepipeline:GetPipelineExecution
                - codepipeline:ListPipelineExecutions
              Resource: '*'
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - 'dynamodb:Query'
                - 'dynamodb:UpdateItem'
                - 'dynamodb:GetItem'
              Resource:
                - 'Fn::Join':
                    - ''
                    - - 'arn:aws:dynamodb:'
                      - Ref: 'AWS::Region'
                      - ':'
                      - Ref: 'AWS::AccountId'
                      - ':table/'
                      - Ref: ExecutionsTable
                - 'Fn::Join':
                    - ''
                    - - 'arn:aws:dynamodb:'
                      - Ref: 'AWS::Region'
                      - ':'
                      - Ref: 'AWS::AccountId'
                      - ':table/'
                      - Ref: ExecutionsTable
                      - '/*'
      Tags:
        CreatedBy: 'release-machine'

  ReleasesTable:
    Type: AWS::Serverless::SimpleTable # More info about SimpleTable Resource: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-simpletable.html
    Properties:
      PrimaryKey:
        Name: ReleaseId
        Type: String
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1
      Tags:
        CreatedBy: 'release-machine'

  ExecutionsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: ExecutionId
          AttributeType: 'S'
        - AttributeName: ReleaseId
          AttributeType: 'S'
      KeySchema:
        - AttributeName: ExecutionId
          KeyType: HASH
      GlobalSecondaryIndexes:
        - IndexName: releaseIndex
          KeySchema:
            - AttributeName: ReleaseId
              KeyType: HASH
          Projection:
            NonKeyAttributes:
              - Pipeline
              - Status
              - Timestamp
            ProjectionType: 'INCLUDE'
          ProvisionedThroughput:
            ReadCapacityUnits: 1
            WriteCapacityUnits: 1
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1
      Tags:
        - Key: 'CreatedBy'
          Value: 'release-machine'

  CloudTrailBucket:
    Type: AWS::S3::Bucket

  CloudTrailForBucket:
    DependsOn:
      - CloudTrailBucketPolicy
    Type: AWS::CloudTrail::Trail
    Properties:
      IsLogging: true
      S3BucketName: !Ref CloudTrailBucket
      EventSelectors:
        - DataResources:
            - Type: AWS::S3::Object
              Values:
                - 'Fn::Join':
                    - ''
                    - - !GetAtt ReleaseBucket.Arn
                      - '/'
          IncludeManagementEvents: false
          ReadWriteType: WriteOnly

  CloudTrailBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref CloudTrailBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AWSCloudTrailAclCheck
            Effect: Allow
            Principal:
              Service: 'cloudtrail.amazonaws.com'
            Action: 's3:GetBucketAcl'
            Resource: !Sub 'arn:aws:s3:::${CloudTrailBucket}'
          - Sid: AWSCloudTrailWrite
            Effect: Allow
            Principal:
              Service: 'cloudtrail.amazonaws.com'
            Action: 's3:PutObject'
            Resource: !Sub 'arn:aws:s3:::${CloudTrailBucket}/AWSLogs/${AWS::AccountId}/*'
            Condition:
              StringEquals:
                's3:x-amz-acl': 'bucket-owner-full-control'

Outputs:
  # Find out more about other implicit resources you can reference within SAM
  # https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-specification-generated-resources.html
  ReleaseStateMachineArn:
    Description: 'Release state machine ARN'
    Value: !Ref ReleaseStateMachine
  ReleaseStateMachineRole:
    Description: 'IAM Role created for Release state machine based on the specified SAM Policy Templates'
    Value: !GetAtt ReleaseStateMachineRole.Arn
  ReleaseBucketName:
    Description: 'Name of the bucket the release manifest should be dropped into'
    Value: !Ref ReleaseBucket
  ReleasesTableName:
    Description: 'Name of the dynamo table the release request should be logged to'
    Value: !Ref ReleasesTable
  ExecutionsTableName:
    Description: 'Name of the dynamo table the pipeline executions should be logged to'
    Value: !Ref ExecutionsTable