codebuild.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Create CodeBuild project to stage pipeline-dashboard'
Parameters:
  StagingBucketPrefix:
    Type: String
    Description: Prefix for bucket to stage artifact to
    Default: pipeline-dashboard-node-0811
  GitHubRepo:
    Type: String
    Description: URL for source code
    Default: https://github.com/stelligent/pipeline-dashboard.git
  GitHubToken:
    Type: String
    Description: Secret. It might look something like 9b189a1654643522561f7b3ebd44a1531a4287af OAuthToken with access to Repo. Go to https://github.com/settings/tokens
    Default: ""
    NoEcho: true
Conditions:
  HasGitHubToken:
    "Fn::Not":
      - "Fn::Equals":
        - ""
        - !Ref GitHubToken
Resources:
  BuildRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: pipeline-dashboard-codebuild
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - codebuild.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: push-image
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Action:
            - s3:CreateBucket
            - s3:ListBucket
            - s3:PutBucketPolicy
            Resource: !Sub arn:aws:s3:::${StagingBucket}
            Effect: Allow
          - Action:
            - s3:GetObject
            - s3:GetObjectVersion
            - s3:PutObject
            Resource: !Sub arn:aws:s3:::${StagingBucket}/*
            Effect: Allow
          - Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Effect: Allow
            Resource: '*'

  BuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      BadgeEnabled: true 
      Environment:
        EnvironmentVariables:
        - Name: STAGING_BUCKET_PREFIX
          Value: !Ref StagingBucketPrefix
        Type: LINUX_CONTAINER
        Image: aws/codebuild/nodejs:12
        ComputeType: BUILD_GENERAL1_SMALL
      Name: pipeline-dashboard
      Description: Stage pipeline-dashboard
      ServiceRole: !GetAtt BuildRole.Arn
      Source:
        Auth: 
          !If
          - HasGitHubToken
          - Type: OAUTH
            Resource: !Ref GitHubToken
          - !Ref AWS::NoValue
        Type: GITHUB
        Location: !Ref GitHubRepo
      # should be true, but webhook from CFN was failing?!
      #Triggers:
      #  Webhook: true 
      Artifacts:
        Type: NO_ARTIFACTS
  StagingBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${StagingBucketPrefix}-${AWS::Region}
  StagingBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref StagingBucket
      PolicyDocument:
        Version: '2012-10-17'
        Id: StagingBucketPolicy
        Statement:
        - Sid: PublicAccess
          Effect: Allow
          Principal: '*'
          Action: s3:GetObject
          Resource: !Sub arn:aws:s3:::${StagingBucket}/*
Outputs:
  CodeBuildProject:
    Value: !Sub https://console.aws.amazon.com/codebuild/home?region=${AWS::Region}#/projects/pipeline-dashboard/view
    Description: CodeBuild project for staging artifacts to the S3 bucket
  StagingBucket:
    Value: !Ref StagingBucket
    Description: S3 bucket for staging the lambda function and CloudFormation template