aws-codecommit-selective-build-trigger.yml

---
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0

# Permission is hereby granted, free of charge, to any person obtaining a copy of this
# software and associated documentation files (the "Software"), to deal in the Software
# without restriction, including without limitation the rights to use, copy, modify,
# merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
# permit persons to whom the Software is furnished to do so.

# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
# INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
# PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS CloudFormation Template to build a docker image build factory.
Parameters:
  ProjectName:
    AllowedPattern: '[a-z0-9.-]*'
    ConstraintDescription: Project Name must contain only lowercase a-z, 0-9 and -
      characters.
    Default: sampletest
    Description: Define the Name of the Project such as test/data etc. (Value must
      be comprised only of lowercase a-z, 0-9, .-)
    Type: String
  LambdaZipS3Bucket:
    Default: codecommit-selective-build
    Description: Define the Name of the S3 Bucket containing Lambda code zip
    Type: String
  LambdaZipS3Key:
    Default: lambda.zip
    Description: Define the Name of the S3 Bucket Key containing Lambda code zip
    Type: String
Resources:
  CodeCommitRepository:
    Type: AWS::CodeCommit::Repository
    Properties:
      RepositoryDescription: !Sub ${ProjectName}CodeRepo
      RepositoryName: !Sub ${ProjectName}coderepo
      Triggers: 
        - Name: MasterTrigger
          CustomData: Project ID sampletest
          DestinationArn: !GetAtt  LambdaTrigger.Arn
          Branches:
          - master
          Events:
          - updateReference
  CodeBuildImageRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
        Version: '2012-10-17'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCodeCommitReadOnly
        - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser
      Path: /
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - logs:CreateLogGroup
                  - logs:DescribeLogGroups
                  - logs:CreateLogStream
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                Effect: Allow
                Resource:
                  - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*'
            Version: '2012-10-17'
          PolicyName: !Sub
            - ${Param1}-RolePolicy
            - Param1: !Sub ${ProjectName}-CodeBuild-ContainerImage
      RoleName: !Sub ${ProjectName}-CodeBuild-Role
  CodeBuildImageJob:
    Type: AWS::CodeBuild::Project
    DependsOn: CodeBuildImageRole
    Properties:
      Artifacts:
        Type: NO_ARTIFACTS
      Description: CodeBuild Project to pull from a GIT repository containing
        a Dockerfile and a "buildspec.yml" file and build a docker image based off
        those artifacts.
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/docker:18.09.0-1.7.0
        PrivilegedMode: true
        Type: LINUX_CONTAINER
      Name: !Sub '${ProjectName}-CodeBuild-Job'
      ServiceRole: !Sub ${ProjectName}-CodeBuild-Role
      Source:
        BuildSpec: |
          version: 0.2
          phases:
            install:
              commands:
                - echo Phase INSTALL was STARTED on `date`
                - echo "Installing Pre-Requisites..."
                - python3 -m pip install pip --upgrade || exit 1
                - echo "Cleaning up un-needed files..." && rm -fr .git .gitignore readme.md README.md Readme.md ReadMe.md || exit 0 && echo "Cleanup Completed!"
                - echo "Logging in to Amazon ECR..."
                - $(aws ecr get-login --region $AWS_DEFAULT_REGION --no-include-email)
                - ECR_REPOSITORY_URI=$AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$ECR_REPO
                - COMMIT_HASH=$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | cut -c 1-7)
                - IMAGE_TAG=${COMMIT_HASH:=latest}
              finally:
                - echo Phase INSTALL was COMPLETED on `date`
                - if [ "$CODEBUILD_BUILD_SUCCEEDING" -eq 1 ]; then echo 'INSTALL SUCCESSFUL'; else echo 'INSTALL FAILED'; exit 1; fi
            build:
              commands:
                - echo Phase BUILD was STARTED on `date`
                - echo "Building the Docker image..."
                - docker build -t $ECR_REPOSITORY_URI:latest .
                - docker tag $ECR_REPOSITORY_URI:latest $ECR_REPOSITORY_URI:$IMAGE_TAG
              finally:
                - echo Phase BUILD was COMPLETED on `date`
                - if [ "$CODEBUILD_BUILD_SUCCEEDING" -eq 1 ]; then echo 'IMAGE BUILD SUCCESSFUL'; else echo 'IMAGE BUILD FAILED'; exit 1; fi
            post_build:
              commands:
                - echo Phase POST_BUILD was STARTED on `date`
                - echo "Pushing the Docker image to ECR..."
                - docker push $ECR_REPOSITORY_URI:latest
                - docker push $ECR_REPOSITORY_URI:$IMAGE_TAG
              finally:
                - echo Phase POST_BUILD was COMPLETED on `date`
                - if [ "$CODEBUILD_BUILD_SUCCEEDING" -eq 1 ]; then echo 'IMAGE POST BUILD SUCCESSFUL'; else echo 'IMAGE POST BUILD FAILED'; exit 1; fi
        Type: NO_SOURCE
      Tags:
        - Key: Project
          Value: !Ref 'ProjectName'
  LambdaTrigger:
    Type: AWS::Lambda::Function
    DependsOn: LambdaTriggerRole
    Properties:
      Code:
        S3Bucket: !Ref 'LambdaZipS3Bucket'
        S3Key: !Ref 'LambdaZipS3Key'
      Description: Lambda function that will recieve CodeCommit events and will trigger
        CodeBuild docker image build job.
      FunctionName: !Sub '${CodeBuildImageJob}-Lambda-Trigger'
      Handler: lambda_code.lambda_handler
      MemorySize: 512
      Role: !Sub
        - arn:aws:iam::${AWS::AccountId}:role/${Param1}
        - Param1: !Sub ${ProjectName}-Lambda-CodeBuild-Trigger-Role
      Runtime: python3.6
      Tags:
        - Key: Project
          Value: !Ref 'ProjectName'
      Timeout: 300
      Environment:
        Variables:
          CODE_BUILD_PROJECT: !Ref CodeBuildImageJob
          ECR_REPO_NAME: !Ref ECRRepository
  LambdaTriggerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - logs:CreateLogGroup
                  - logs:DescribeLogGroups
                  - logs:CreateLogStream
                  - logs:DescribeLogStreams
                  - logs:PutLogEvents
                Effect: Allow
                Resource:
                  - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*'
                Sid: LogAccessPolicy
              - Action:
                  - codecommit:GetTree
                  - codecommit:BatchGetCommits
                  - codecommit:GetCommit
                  - codecommit:GetCommitHistory
                  - codecommit:GetDifferences
                  - codecommit:GetReferences
                  - codecommit:GetObjectIdentifier
                  - codecommit:BatchGetCommits
                Effect: Allow
                Resource:
                  - !Sub 'arn:aws:codecommit:${AWS::Region}:${AWS::AccountId}:${ProjectName}coderepo'
                Sid: CodeCommitRead
              - Action:
                  - codebuild:StartBuild
                Effect: Allow
                Resource:
                  - !GetAtt CodeBuildImageJob.Arn
                Sid: CodeBuildStartPolicy
            Version: '2012-10-17'
          PolicyName: !Sub
            - ${Param1}-RolePolicy
            - Param1: !Sub ${ProjectName}-Lambda-CodeBuild-Trigger
      RoleName: !Sub ${ProjectName}-Lambda-CodeBuild-Trigger-Role
  PermissionForCodeCommitToInvokeLambda:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref 'LambdaTrigger'
      Principal: codecommit.amazonaws.com
  ECRRepository:
      Type: AWS::ECR::Repository
      Properties:
        RepositoryName: !Sub ${ProjectName}-imagerepo