template.yml

# Template resources
Resources:
  # ░██████╗██████╗░
  # ██╔════╝╚════██╗
  # ╚█████╗░░█████╔╝
  # ░╚═══██╗░╚═══██╗
  # ██████╔╝██████╔╝
  # ╚═════╝░╚═════╝░
  # S3 bucket where artifacts will be stored
  ArtifactBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join
        - ""
        - - Ref: ProjectName
          - -artifacts
      Tags:
        - Key: Project
          Value:
            Ref: ProjectName
      # Determines how long artifacts are stored
      LifecycleConfiguration:
        Rules:
          - ExpirationInDays:
              Ref: ArtifactLifetimeInDays
            Status: Enabled

  # S3 bucket where the backend will be stored
  BackendBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join
        - ""
        - - Ref: ProjectName
          - -backend
      Tags:
        - Key: Project
          Value:
            Ref: ProjectName

  # S3 bucket where the frontend will be stored
  FrontendBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join
        - ""
        - - Ref: ProjectName
          - -frontend
      Tags:
        - Key: Project
          Value:
            Ref: ProjectName
      WebsiteConfiguration:
        IndexDocument:
          Ref: IndexDocumentName
        ErrorDocument:
          Ref: ErrorDocumentName

  # ░█████╗░██╗░░░░░░█████╗░██╗░░░██╗██████╗░███████╗██████╗░░█████╗░███╗░░██╗████████╗
  # ██╔══██╗██║░░░░░██╔══██╗██║░░░██║██╔══██╗██╔════╝██╔══██╗██╔══██╗████╗░██║╚══██╔══╝
  # ██║░░╚═╝██║░░░░░██║░░██║██║░░░██║██║░░██║█████╗░░██████╔╝██║░░██║██╔██╗██║░░░██║░░░
  # ██║░░██╗██║░░░░░██║░░██║██║░░░██║██║░░██║██╔══╝░░██╔══██╗██║░░██║██║╚████║░░░██║░░░
  # ╚█████╔╝███████╗╚█████╔╝╚██████╔╝██████╔╝██║░░░░░██║░░██║╚█████╔╝██║░╚███║░░░██║░░░
  # ░╚════╝░╚══════╝░╚════╝░░╚═════╝░╚═════╝░╚═╝░░░░░╚═╝░░╚═╝░╚════╝░╚═╝░░╚══╝░░░╚═╝░░░
  # CloudFront Distribution serving the frontend
  Distribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Aliases:
          - Ref: DomainName
        # Distribution cache behaviors.
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
          # Note: This is the Managed-CachingOptimized policy
          CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6
          TargetOriginId: S3-origin
          ViewerProtocolPolicy: redirect-to-https
        DefaultRootObject: index.html
        Enabled: True
        HttpVersion: http2
        Origins:
          # The frontend S3 bucket
          - DomainName: !GetAtt [FrontendBucket, DomainName]
            Id: S3-origin
            S3OriginConfig:
              OriginAccessIdentity: !Join
                - ""
                - - "origin-access-identity/cloudfront/"
                  - Ref: FrontendOriginAccessIdentity
        PriceClass:
          Ref: CloudFrontPriceClass
        # SSL certificate
        ViewerCertificate:
          AcmCertificateArn:
            Ref: CloudFrontCertificateARN
          MinimumProtocolVersion: TLSv1.2_2019
          SslSupportMethod: sni-only
      Tags:
        - Key: Project
          Value:
            Ref: ProjectName

  # CloudFront Origin Access Identity (OAI) for accessing the frontend S3 bucket
  FrontendOriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: Origin Access Identity used by the distribution to reach the frontend bucket

  # ██████╗░██╗██████╗░███████╗██╗░░░░░██╗███╗░░██╗███████╗
  # ██╔══██╗██║██╔══██╗██╔════╝██║░░░░░██║████╗░██║██╔════╝
  # ██████╔╝██║██████╔╝█████╗░░██║░░░░░██║██╔██╗██║█████╗░░
  # ██╔═══╝░██║██╔═══╝░██╔══╝░░██║░░░░░██║██║╚████║██╔══╝░░
  # ██║░░░░░██║██║░░░░░███████╗███████╗██║██║░╚███║███████╗
  # ╚═╝░░░░░╚═╝╚═╝░░░░░╚══════╝╚══════╝╚═╝╚═╝░░╚══╝╚══════╝
  # Actual pipeline
  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      # Artifact store location
      ArtifactStore:
        Type: S3
        Location:
          Ref: ArtifactBucket

      # Add the IAM role to the bucket
      RoleArn: !GetAtt [PipelineRole, Arn]

      # Stages
      Stages:
        # Stage for loading code from Github
        - Name: Source
          Actions:
            # Determine the action type. See https://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.html#actions-valid-providers
            - ActionTypeId:
                Category: Source
                Owner: AWS
                Provider: CodeStarSourceConnection
                Version: "1"

              # Connect the pipeline to the git provider. The CodeStar connection could, as of right now, be either Github or Bitbucket. See documentation for latest info: https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference-CodestarConnectionSource.html
              Configuration:
                ConnectionArn:
                  Ref: CodeStarConnectionARN
                FullRepositoryId: !Join
                  - ""
                  - - Ref: RepositoryOwner
                    - "/"
                    - Ref: RepositoryName
                BranchName:
                  Ref: BranchName
                OutputArtifactFormat: "CODE_ZIP"

              # Name the output of this action. Note that this is the name that will be referenced further down the pipeline
              OutputArtifacts:
                - Name: SourceArtifact

              # Action name
              Name: Get_source

        # Stage for building the code loaded from Github
        - Name: Build-and-zip
          Actions:
            # Action that builds the frontend
            - ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1

              # Connect the build project
              Configuration:
                ProjectName:
                  Ref: FrontendBuilder
                PrimarySource: SourceArtifact

              # Get the source code artifact
              InputArtifacts:
                - Name: SourceArtifact

              # Output the build files
              OutputArtifacts:
                - Name: FrontendBuild

              # Action name
              Name: Build_frontend

              # Action that builds the backend
            - ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: 1

              # Connect the build project
              Configuration:
                ProjectName:
                  Ref: BackendBuilder
                PrimarySource: SourceArtifact

              # Get the source code artifact
              InputArtifacts:
                - Name: SourceArtifact

              # Output the build files
              OutputArtifacts:
                - Name: BackendBuild
                - Name: BuildData

              # Action name
              Name: Build_backend

        # Stage for deploying the build
        - Name: Deploy-to-S3
          Actions:
            # Action that deploys the frontend
            - ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: S3
                Version: 1

              # Configure where to deploy
              Configuration:
                BucketName:
                  Ref: FrontendBucket
                Extract: True

              # Get the artifact produced in the above stage
              InputArtifacts:
                - Name: FrontendBuild

              # Action name
              Name: Deploy_frontend_build

            # Action that deploys the backend
            - ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: S3
                Version: 1

              # Configure where to deploy
              Configuration:
                BucketName:
                  Ref: BackendBucket
                Extract: True

              # Get the artifact produced in the above stage
              InputArtifacts:
                - Name: BackendBuild

              # Action name
              Name: Deploy_backend_build

        # Stage that creates a CloudFormation changeset for the backend
        - Name: Create-backend-changeset
          Actions:
            # Action that creates a CloudFormation changeset for the backend
            - ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1

              # Configuration for how the changeset is created
              Configuration:
                ActionMode: CHANGE_SET_REPLACE
                Capabilities: CAPABILITY_IAM
                ChangeSetName: BackendChanges
                ParameterOverrides: !Sub |
                  {
                    "BackendS3Bucket": "${BackendBucket}",
                    "BuildId": { "Fn::GetParam" : ["BuildData", "buildData.json", "BuildId"] }
                  }
                RoleArn: !GetAtt [ChangeSetRole, Arn]
                StackName:
                  Ref: BackendStack

                # Mention where the template and template config is located
                TemplatePath: SourceArtifact::backend/template.yml
                TemplateConfiguration: SourceArtifact::backend/stack-config.json

              # Get the source
              InputArtifacts:
                - Name: SourceArtifact
                - Name: BuildData
              Name: CreateBackendChangeset

        # Stage for verifying backend updates
        - Name: Approve-backend-changeset
          Actions:
            # Manual approval action
            - ActionTypeId:
                Category: Approval
                Owner: AWS
                Provider: Manual
                Version: 1
              Configuration:
                NotificationArn:
                  Ref: ApprovalSNSTopicARN
                CustomData: !Join
                  - ""
                  - - "The pipeline for "
                    - Ref: ProjectName
                    - " has new changes awaiting manual approval"
              InputArtifacts: []
              Name: BackendApproval

        # Stage that executes the backend changeset (if approved)
        - Name: Execute-backend-changeset
          Actions:
            # Action that executes the backend changeset
            - ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1

              # Configuration for how the changeset is executed
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                Capabilities: CAPABILITY_IAM
                ChangeSetName: BackendChanges
                RoleArn: !GetAtt [ChangeSetRole, Arn]
                StackName:
                  Ref: BackendStack
              InputArtifacts: []
              Name: ExecuteBackendChangeset

      # Pipeline name
      Name: !Join
        - ""
        - - Ref: ProjectName
          - "-pipeline"
      # Tags
      Tags:
        - Key: Project
          Value: ProjectName

  # ██████╗░██╗░░░██╗██╗██╗░░░░░██████╗░███████╗██████╗░░██████╗
  # ██╔══██╗██║░░░██║██║██║░░░░░██╔══██╗██╔════╝██╔══██╗██╔════╝
  # ██████╦╝██║░░░██║██║██║░░░░░██║░░██║█████╗░░██████╔╝╚█████╗░
  # ██╔══██╗██║░░░██║██║██║░░░░░██║░░██║██╔══╝░░██╔══██╗░╚═══██╗
  # ██████╦╝╚██████╔╝██║███████╗██████╔╝███████╗██║░░██║██████╔╝
  # ╚═════╝░░╚═════╝░╚═╝╚══════╝╚═════╝░╚══════╝╚═╝░░╚═╝╚═════╝░
  # CodeBuild project for the backend
  BackendBuilder:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE

      # Build environment
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/amazonlinux2-x86_64-standard:3.0
        Type: LINUX_CONTAINER

      # Name of the CodeBuild project
      Name: !Join
        - ""
        - - Ref: ProjectName
          - "-backend-builder"

      # Queuing timeout
      QueuedTimeoutInMinutes: 20

      # IAM role for the builder
      ServiceRole: !GetAtt [BuildersRole, Arn]

      Source:
        BuildSpec: backend/buildspec.yml
        Type: CODEPIPELINE
      Tags:
        - Key: Project
          Value:
            Ref: ProjectName

      # Building timeout
      TimeoutInMinutes: 5

  # CodeBuild project for the frontend
  FrontendBuilder:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE

      # Build environment
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/amazonlinux2-x86_64-standard:3.0
        Type: LINUX_CONTAINER
        # Environment variable used for clearing the bucket before deployment
        EnvironmentVariables:
          - Name: OUTPUT_BUCKET
            Value:
              Ref: FrontendBucket
            Type: PLAINTEXT

      # Name of the CodeBuild project
      Name: !Join
        - ""
        - - Ref: ProjectName
          - "-frontend-builder"

      # Queuing timeout
      QueuedTimeoutInMinutes: 20

      # IAM role for the builder
      ServiceRole: !GetAtt [BuildersRole, Arn]

      Source:
        BuildSpec: frontend/buildspec.yml
        Type: CODEPIPELINE
      Tags:
        - Key: Project
          Value:
            Ref: ProjectName

      # Building timeout
      TimeoutInMinutes: 5

  # ░█████╗░██╗░░░░░░█████╗░██╗░░░██╗██████╗░███████╗░█████╗░██████╗░███╗░░░███╗░█████╗░████████╗██╗░█████╗░███╗░░██╗
  # ██╔══██╗██║░░░░░██╔══██╗██║░░░██║██╔══██╗██╔════╝██╔══██╗██╔══██╗████╗░████║██╔══██╗╚══██╔══╝██║██╔══██╗████╗░██║
  # ██║░░╚═╝██║░░░░░██║░░██║██║░░░██║██║░░██║█████╗░░██║░░██║██████╔╝██╔████╔██║███████║░░░██║░░░██║██║░░██║██╔██╗██║
  # ██║░░██╗██║░░░░░██║░░██║██║░░░██║██║░░██║██╔══╝░░██║░░██║██╔══██╗██║╚██╔╝██║██╔══██║░░░██║░░░██║██║░░██║██║╚████║
  # ╚█████╔╝███████╗╚█████╔╝╚██████╔╝██████╔╝██║░░░░░╚█████╔╝██║░░██║██║░╚═╝░██║██║░░██║░░░██║░░░██║╚█████╔╝██║░╚███║
  # ░╚════╝░╚══════╝░╚════╝░░╚═════╝░╚═════╝░╚═╝░░░░░░╚════╝░╚═╝░░╚═╝╚═╝░░░░░╚═╝╚═╝░░╚═╝░░░╚═╝░░░╚═╝░╚════╝░╚═╝░░╚══╝
  # CloudFormation stack where backend resources will be placed
  BackendStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL:
        Ref: InitialBackendTemplateURL
      Tags:
        - Key: Project
          Value:
            Ref: ProjectName

  # ██╗░█████╗░███╗░░░███╗
  # ██║██╔══██╗████╗░████║
  # ██║███████║██╔████╔██║
  # ██║██╔══██║██║╚██╔╝██║
  # ██║██║░░██║██║░╚═╝░██║
  # ╚═╝╚═╝░░╚═╝╚═╝░░░░░╚═╝
  # Bucket policy for the frontend bucket
  FrontendBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: FrontendBucket
      PolicyDocument:
        Id: !Join
          - ""
          - - Ref: FrontendBucket
            - "_policy"
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Join
                - ""
                - - "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity "
                  - Ref: FrontendOriginAccessIdentity
            Action: "s3:GetObject"
            Resource: !Join
              - ""
              - - "arn:aws:s3:::"
                - Ref: FrontendBucket
                - /*

  # IAM role for the builders
  BuildersRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: ["sts:AssumeRole"]
            Effect: Allow
            Principal:
              Service: [codebuild.amazonaws.com]

      # Builder permissions
      Policies:
        - PolicyName: "root"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              # Cloudwatch permissions
              - Effect: "Allow"
                Action:
                  - "cloudwatch:*"
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource: "*"
              # Permissions for retrieving the source artifact
              - Effect: "Allow"
                Action:
                  - "s3:PutObject"
                  - "s3:GetObject"
                  - "s3:GetObjectVersion"
                Resource: !Join
                  - ""
                  - - !GetAtt [ArtifactBucket, Arn]
                    - /*
              # Permissions for clearing the output bucket
              - Effect: "Allow"
                Action: "s3:ListBucket"
                Resource: !GetAtt [FrontendBucket, Arn]
              - Effect: "Allow"
                Action: "s3:DeleteObject"
                Resource: !Join
                  - ""
                  - - !GetAtt [FrontendBucket, Arn]
                    - /*

  # IAM role for the pipeline
  PipelineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: ["sts:AssumeRole"]
            Effect: Allow
            Principal:
              Service: [codepipeline.amazonaws.com]

      # Pipeline permissions
      Policies:
        - PolicyName: "root"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              # Codestar permissions
              - Effect: "Allow"
                Action: "codestar-connections:UseConnection"
                Resource:
                  Ref: CodeStarConnectionARN
              # Bucket permissions
              - Effect: "Allow"
                Action: "s3:*"
                Resource:
                  - !Join
                    - ""
                    - - !GetAtt [ArtifactBucket, Arn]
                      - /*
                  - !Join
                    - ""
                    - - !GetAtt [BackendBucket, Arn]
                      - /*
                  - !Join
                    - ""
                    - - !GetAtt [FrontendBucket, Arn]
                      - /*
              # Codebuild permissions
              - Effect: "Allow"
                Action:
                  - "codebuild:StartBuild"
                  - "codebuild:StartBuildBatch"
                  - "codebuild:BatchGetBuilds"
                  - "codebuild:BatchGetBuildBatches"
                Resource:
                  - !GetAtt [BackendBuilder, Arn]
                  - !GetAtt [FrontendBuilder, Arn]
              # SNS permissions
              - Effect: "Allow"
                Action: "sns:Publish"
                Resource:
                  Ref: ApprovalSNSTopicARN
              - Effect: "Allow"
                Action:
                  - "cloudformation:CreateChangeSet"
                  - "cloudformation:DeleteChangeSet"
                  - "cloudformation:DescribeChangeSet"
                  - "cloudformation:DescribeStacks"
                  - "cloudformation:ExecuteChangeSet"
                Resource:
                  Ref: BackendStack
              # Allow this role to pass on permissions to the changeset creator
              - Effect: "Allow"
                Action: "iam:PassRole"
                Resource: !GetAtt [ChangeSetRole, Arn]

  # IAM role used by the pipeline action creating the changeset
  ChangeSetRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: ["sts:AssumeRole"]
            Effect: Allow
            Principal:
              Service: [cloudformation.amazonaws.com]

      # Action permissions
      Policies:
        - PolicyName: "root"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              # Permissions used when creating resources. Change these as needed, right now they are set up for serverless apps
              - Effect: Allow
                Action:
                  - "apigateway:*"
                  - "iam:AttachRolePolicy"
                  - "iam:CreateRole"
                  - "iam:DeleteRole"
                  - "iam:DeleteRolePolicy"
                  - "iam:DetachRolePolicy"
                  - "iam:GetRole"
                  - "iam:getRolePolicy"
                  - "iam:PassRole"
                  - "iam:PutRolePolicy"
                  - "iam:TagRole"
                  - "lambda:*"
                  - "dynamodb:*"
                Resource: "*"
              # Access to retrieve items from the backend bucket
              - Effect: Allow
                Action:
                  - "s3:GetObject"
                Resource: !Join
                  - ""
                  - - !GetAtt [BackendBucket, Arn]
                    - /*

# Template parameters
Parameters:
  # ARN of the SNS topic used to notify about awaiting manual approvals
  ApprovalSNSTopicARN:
    Type: String
    Description: Enter the ARN of the SNS topic you want to use to send notifications about awaiting manual approvals

  # How many days artifacts are stored
  ArtifactLifetimeInDays:
    Type: Number
    Description: Specify how many days you want artifacts to be stored for (1->180 days accepted)
    Default: 30
    MaxValue: 180
    MinValue: 1

  # Branch name
  BranchName:
    Type: String
    Description: Enter the branch name that you want to be used for the build

  # ARN of the SSL certificate to be used by the CloudFront Distribution
  CloudFrontCertificateARN:
    Type: String
    Description: Enter the ARN of the Amazon Certificate Manager certificate to be used by the CloudFront Distribution

  # CloudFront distribution price class
  CloudFrontPriceClass:
    Type: String
    Default: PriceClass_100
    AllowedValues:
      - PriceClass_100
      - PriceClass_200
      - PriceClass_All
    Description: Enter the allowed price class for the CloudFront Distribution

  # CodeStar Connection
  CodeStarConnectionARN:
    Type: String
    Description: Enter the ARN of the CodeStar connection you want to use. Existing connecitons can be found under Developer Tools > Settings > Connections

  # Domain name used by the CloudFront distribution
  DomainName:
    Type: String
    Description: Enter the domain name to be used by the CloudFront Distribution

  # Name of the error file
  ErrorDocumentName:
    Type: String
    Default: error.html
    Description: Enter the name (or path) of your error file

  # Name of the index file
  IndexDocumentName:
    Type: String
    Default: index.html
    Description: Enter the name (or path) of your index file

  # S3 link to where the initial backend CloudFormation template is stored
  InitialBackendTemplateURL:
    Type: String
    Description: Enter the link to your initial backend CloudFormation template. Can be empty (see https://github.com/stelligent/empty-stack/blob/master/empty-stack.yml)

  # Then name of the project
  ProjectName:
    Type: String
    Description: Enter what you want to call this project. Must be lowercase. Used for naming/tagging resources
    AllowedPattern: "[a-z0-9_-]+"

  # Github repository name
  RepositoryName:
    Type: String
    Description: Enter the name of the repository you want to build

    # Github username
  RepositoryOwner:
    Type: String
    Description: Enter the git provider username of the repository owner

# Template metadata
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "General"
        Parameters:
          - ProjectName
      - Label:
          default: "Pipeline configuration"
        Parameters:
          - ApprovalSNSTopicARN
          - ArtifactLifetimeInDays
          - InitialBackendTemplateURL
      - Label:
          default: "Git configuration"
        Parameters:
          - CodeStarConnectionARN
          - RepositoryOwner
          - RepositoryName
          - BranchName
      - Label:
          default: "Hosting configuration"
        Parameters:
          - DomainName
          - CloudFrontCertificateARN
          - CloudFrontPriceClass
          - IndexDocumentName
          - ErrorDocumentName

# Template outputs
Outputs:
  CloudFrontURL:
    Description: The URL of the CloudFront Distribution. Point your DNS to this
    Value: !GetAtt [Distribution, DomainName]