pipeline.yaml

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31

Parameters:
  GitHubOwner:
    Type: String
    Default: superwerker
  RepositoryName:
    Type: String
    Default: superwerker
  BranchName:
    Type: String
    Default: main
  OrganizationsVendingMachineEndpoint:
    Type: String
  GithubTokenSecretsManagerPath:
    Type: String
    Default: /superwerker/github-token
  RootMailDomain:
    Type: String

Resources:

  SuperwerkerBootstrapPipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt SuperwerkerBootstrapPipelineRole.Arn
      Stages:
        - Name: Source
          Actions:
            - Name: SourceAction
              RunOrder: 1
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: '1'
                Provider: GitHub
              OutputArtifacts:
                - Name: SourceOutput
              Namespace: source
              Configuration:
                Owner: !Ref GitHubOwner
                Repo: !Ref RepositoryName
                Branch: !Ref BranchName
                OAuthToken: '{{resolve:secretsmanager:/superwerker/github-token:SecretString}}'
                PollForSourceChanges: false

        - Name: TestSuperwerker
          Actions:
            - ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: "1"
              Configuration:
                ProjectName: !Ref BuildAndTestProject
                EnvironmentVariables: !Sub |
                  [
                    {
                      "name": "TEMPLATE_BUCKET_NAME",
                      "value": "${DeploymentBucket}"
                    },
                    {
                      "name": "TEMPLATE_REGION",
                      "value": "eu-west-1"
                    }
                  ]
                BatchEnabled: true
              InputArtifacts:
                - Name: SourceOutput
              Name: BuildAndTest
              RunOrder: 50

      ArtifactStore:
        Type: S3
        Location: !Ref SuperwerkerUpdatePipelineArtifactStore

  SuperwerkerBootstrapPipelineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codepipeline.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess # FIXME: least privilege

  SuperwerkerUpdatePipelineArtifactStore:
    Type: AWS::S3::Bucket
    Properties:
      LifecycleConfiguration:
        Rules:
          - ExpirationInDays: 14
            Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          -  ServerSideEncryptionByDefault:
               SSEAlgorithm: AES256

  CodePipelineSchedulerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
        Version: 2012-10-17

  CodePipelineSchedulerRolePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - codepipeline:StartPipelineExecution
            Effect: Allow
            Resource: !Sub arn:${AWS::Partition}:codepipeline:${AWS::Region}:${AWS::AccountId}:${SuperwerkerBootstrapPipeline}
        Version: 2012-10-17
      PolicyName: !Sub ${SuperwerkerBootstrapPipeline}-scheduler-role-policy
      Roles:
        - !Ref CodePipelineSchedulerRole

  CodePipelineScheduler:
    Type: AWS::Events::Rule
    Properties:
      ScheduleExpression: rate(1 day)
      State: DISABLED
      RoleArn: !GetAtt CodePipelineSchedulerRole.Arn
      Targets:
        - Arn: !Sub arn:${AWS::Partition}:codepipeline:${AWS::Region}:${AWS::AccountId}:${SuperwerkerBootstrapPipeline}
          Id: pipeline-scheduler
          RoleArn: !GetAtt CodePipelineSchedulerRole.Arn

  DeploymentBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: superwerker-deployment

  ReleasesBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: superwerker-releases

  DeploymentBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref DeploymentBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: PublicRead
            Effect: Allow
            Principal: '*'
            Action:
              - s3:GetObject
              - s3:GetObjectVersion
            Resource: !Sub ${DeploymentBucket.Arn}/*


  ReleasesBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ReleasesBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: PublicRead
            Effect: Allow
            Principal: '*'
            Action:
              - s3:GetObject
              - s3:GetObjectVersion
            Resource: !Sub ${ReleasesBucket.Arn}/*

  BuildAndTestProject:
    Type: AWS::CodeBuild::Project
    Properties:
      TimeoutInMinutes: 180
      BuildBatchConfig:
        ServiceRole: !GetAtt BuildAndTestProjectRole.Arn
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/amazonlinux2-x86_64-standard:4.0
        Type: LINUX_CONTAINER
        PrivilegedMode: true
        EnvironmentVariables:
          - Name: ROOT_MAIL_DOMAIN
            Value: !Ref RootMailDomain
          - Name: ORGANIZATIONS_VENDING_MACHINE_ENDPOINT
            Value: !Ref OrganizationsVendingMachineEndpoint
          - Name: CAPTCHA_API_KEY
            Value: /superwerker/tests/2captcha_api_key
            Type: SECRETS_MANAGER
          - Name: SUPERWERKER_CLEANUP_STATE_MACHINE
            Value: !ImportValue superwerker-tests-CleanupStateMachine

      ServiceRole: !GetAtt BuildAndTestProjectRole.Arn
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: tests/buildspec.yaml

  BuildAndTestProjectRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          Effect: Allow
          Principal:
            Service:
              - codebuild.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess # FIXME: least privilege

  DeploymentBucketUser:
    Type: AWS::IAM::User
    Properties:
      Policies:
        - PolicyName: !Sub 'publish'
          PolicyDocument:
            Statement:
            - Sid: VisualEditor0
              Effect: Allow
              Action: s3:ListObjects
              Resource: "*"
            - Sid: VisualEditor1
              Effect: Allow
              Action:
              - s3:PutObject
              - s3:GetObject
              - s3:PutObjectAcl
              Resource: !Sub ${DeploymentBucket.Arn}/*
            - Sid: VisualEditor2
              Effect: Allow
              Action: s3:ListBucket
              Resource: !Sub ${DeploymentBucket.Arn}


  ReleasesBucketUser:
    Type: AWS::IAM::User
    Properties:
      Policies:
        - PolicyName: !Sub 'publish'
          PolicyDocument:
            Statement:
            - Sid: VisualEditor0
              Effect: Allow
              Action: s3:ListObjects
              Resource: "*"
            - Sid: VisualEditor1
              Effect: Allow
              Action:
              - s3:PutObject
              - s3:GetObject
              - s3:PutObjectAcl
              Resource: !Sub ${ReleasesBucket.Arn}/*
            - Sid: VisualEditor2
              Effect: Allow
              Action: s3:ListBucket
              Resource: !Sub ${ReleasesBucket.Arn}
            - Effect: Allow
              Action:
                - codebuild:StartBuild
                - codebuild:BatchGetBuilds
              Resource: !Sub arn:aws:codebuild:eu-west-1:824014778649:project/build-pull-request
            - Effect: Allow
              Action:
                - logs:GetLogEvents
              Resource: "*"
            - Effect: Allow
              Action:
                - s3:PutObject
                - s3:GetObject
                - s3:PutObjectAcl
              Resource: !Sub arn:aws:s3:::superwerker-assets-*/*
            - Effect: Allow
              Action:
                - s3:ListBucket
                - s3:GetBucketLocation
                - s3:GetEncryptionConfiguration
              Resource: !Sub arn:aws:s3:::superwerker-assets-*

  DeploymentBucketUserAccessKey:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref DeploymentBucketUser

  ReleasesBucketUserAccessKey:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref ReleasesBucketUser

  # We use GitHub actions with OIDC, see the following link for more information:
  # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services
  # The following resources fails to be created by CloudFormation, so we have to create them manually
  #  GitHubOidc:
  #    Type: AWS::IAM::OIDCProvider
  #    Properties:
  #      Url: https://token.actions.githubusercontent.com
  #      ClientIdList:
  #        - sts.amazonaws.com
  #      ThumbprintList:
  #        - "6938fd4d98bab03faadb97b34396831e3780aea1"

  GitHubActionsSuperwerkerTestRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: gh-actions-superwerker-test
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Federated: !Sub arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com
            Action: sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
               "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
              StringLike:
               "token.actions.githubusercontent.com:sub": "repo:superwerker/superwerker:*"
      Policies:
        - PolicyName: 'trigger-codebuild'
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds
                Resource: !Sub arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/build-pull-request
              - Effect: Allow
                Action:
                  - logs:GetLogEvents
                Resource: "*"

  GitHubActionsSuperwerkerReleaseRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: gh-actions-superwerker-release
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Federated: !Sub arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com
            Action: sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
              StringLike:
                "token.actions.githubusercontent.com:sub": "repo:superwerker/superwerker:ref:refs/heads/main"
      Policies:
        - PolicyName: !Sub 'publish'
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action: s3:ListObjects
                Resource: "*"
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:PutObjectAcl
                Resource: !Sub ${ReleasesBucket.Arn}/*
              - Effect: Allow
                Action: s3:ListBucket
                Resource: !Sub ${ReleasesBucket.Arn}
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:PutObjectAcl
                Resource: !Sub arn:aws:s3:::superwerker-assets-*/*
              - Effect: Allow
                Action:
                  - s3:ListBucket
                  - s3:GetBucketLocation
                  - s3:GetEncryptionConfiguration
                Resource: !Sub arn:aws:s3:::superwerker-assets-*

Outputs:
  DeploymentBucket:
    Value: !Ref DeploymentBucket
  DeploymentBucketUserAccessKey:
    Value: !Ref DeploymentBucketUserAccessKey
  DeploymentBucketUserSecretAccessKey:
    Value: !GetAtt DeploymentBucketUserAccessKey.SecretAccessKey

  ReleasesBucket:
    Value: !Ref ReleasesBucket
  ReleasesBucketUserAccessKey:
    Value: !Ref ReleasesBucketUserAccessKey
  ReleasesBucketUserSecretAccessKey:
    Value: !GetAtt ReleasesBucketUserAccessKey.SecretAccessKey