codebuild-integrations/codebuild-template.yml at master · poltorres7/codebuild-integrations · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
AWSTemplateFormatVersion: '2010-09-09'
Metadata:
  Course: Codebuild automation
Description: Creates a codebuild to deploy lambdas

Parameters:
  Env:
    Type: String
  BuildSpec:
    Type: String
    Description: "Path to locate buildSpec"
  CodeBuildType:
    Type: String
    Description: "Type of codebuild to name these codebuild resources"
  Location:
    Type: String
    Description: "Git repository"
  SecondaryLocation:
    Type: String
    Description: "Git repository"

Resources:
  CodebuildSamDeploy:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub "${Env}-${CodeBuildType}"
      ServiceRole: !Ref CodeBuildRole
      Description: !Sub "Codebuild base template for type: ${CodeBuildType}"
      Source:
        Type: "GITHUB"
        BuildSpec: !Ref BuildSpec
        GitCloneDepth: 1
        GitSubmodulesConfig:
          FetchSubmodules: false
        InsecureSsl: false
        Location: !Ref Location
      SecondarySources:
        - Type: "GITHUB"
          Location: !Ref SecondaryLocation
          GitCloneDepth: 1
          GitSubmodulesConfig:
            FetchSubmodules: false
          SourceIdentifier: "lambdas"
      TimeoutInMinutes: 5
      QueuedTimeoutInMinutes: 30
      Artifacts:
        Type: NO_ARTIFACTS
      Cache:
        Type: NO_CACHE
      Environment:
        Type: LINUX_CONTAINER
        Image: aws/codebuild/standard:5.0
        ComputeType: BUILD_GENERAL1_SMALL
        ImagePullCredentialsType: "CODEBUILD"
        PrivilegedMode: false
        EnvironmentVariables:
          -
            Name: "Env"
            Type: "PLAINTEXT"
            Value: !Ref Env
      Tags:
        - Key: Env
          Value: !Ref Env
        - Key: Course
          Value: DevOps
      BadgeEnabled: false
      LogsConfig:
        CloudWatchLogs:
          Status: ENABLED
          GroupName: lambda-deploy-log
      ConcurrentBuildLimit: 3
      SourceVersion: master
#      Triggers:
#        Webhook: true
#        FilterGroups:
#          - - Type: Event
#              Pattern: PUSH

  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      Description: Role to be used by codebuild
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: codebuild.amazonaws.com
      Path: /
      RoleName: !Sub "codebuild-${Env}-${CodeBuildType}-role"

#  RootInstanceProfile:
#    Type: AWS::IAM::InstanceProfile
#    Properties:
#      Roles:
#        - !Ref CodeBuildRole

  Policy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub "${Env}-codebuild-${CodeBuildType}-policy"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - 'lambda:CreateAlias'
              - 'lambda:CreateFunction'
              - 'lambda:GetFunction'
              - 'lambda:GetFunctionCodeSigningConfig'
              - 'lambda:ListTags'
              - 'lambda:ListVersionsByFunction'
              - 'lambda:PublishVersion'
              - 'lambda:TagResource'
              - 'lambda:UpdateAlias'
              - 'lambda:UpdateFunctionCode'
              - 'lambda:UpdateFunctionConfiguration'
            Resource: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:*"
          - Effect: Allow
            Action:
              - 's3:PutObject'
              - 's3:GetObject'
            Resource:
              - !Sub "arn:aws:s3:::lambdas-zips-${AWS::Region}-*"
              - !Sub "arn:aws:s3:::lambdas-zips-${AWS::Region}-*/*"
          - Effect: Allow
            Action:
              - 'iam:*'
            Resource: "*"
          - Effect: Allow
            Action:
              - 'cloudformation:*'
            Resource:
              - !Sub 'arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/*'
              - !Sub 'arn:aws:cloudformation:${AWS::Region}:aws:transform/Serverless-2016-10-31'
          - Effect: Allow
            Action:
              - 's3:GetObject'
            Resource:
              - !Sub "arn:aws:s3:::codepipeline-${AWS::Region}-*"
              - !Sub "arn:aws:s3:::codepipeline-${AWS::Region}-*/*"
          - Effect: Allow
            Action:
              - 'logs:CreateLogStream'
              - 'logs:PutLogEvents'
            Resource:
              - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:lambda-deploy-log:log-stream:*"
          - Effect: Allow
            Action:
              - 'codestar-connections:UseConnection'
            Resource:
              - !Sub "arn:aws:codestar-connections:${AWS::Region}:${AWS::AccountId}:connection/*"
      Roles:
        - !Ref CodeBuildRole