DevSecOps_CodePipeline_Sample.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: Template to build Container DevSecOps AWS CodePipeline

Parameters:
  CodeBuildProjectName:
    Type: String
    Description: Name for the CodeBuild Project
    Default: container-scan-project
  EcrRepositoryArn:
    Type: String
    Description: ECR Repository ARN
  EcrRepositoryUri:
    Type: String
    Description: ECR Repository URI
  EcsServiceName:
    Type: String
    Description: Name of ECS Service to update
    Default: apache-website-service
  ECSClusterName:
    Type: String
    Description: ECS Cluster to deploy the Containers.
    Default: apache-demo-cluster
  ApacheWebsiteCodeCommitRepoName:
    Type: String
    Description: Apache Website CodeCommit Repository
    Default: apache-website
  ApacheWebsiteCodeCommitRepoArn:
    Type: String
    Description: Apache Website CodeCommit Repository ARN
Resources:
  PipleineArtifactBucket:
    Type: "AWS::S3::Bucket"
  CodeBuildLogGroup:
    Type: "AWS::Logs::LogGroup"
    Properties:
      LogGroupName:
        Fn::Join: ["",["/aws/codebuild/", !Ref CodeBuildProjectName]]
  CodeBuildServiceRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action: "sts:AssumeRole"
            Principal:
              Service: "codebuild.amazonaws.com"
  CodeBuildServiceRolePolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      Roles: [!Ref CodeBuildServiceRole]
      PolicyName: CodeBuildTrustPolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - 
            Sid: "CloudWatchLogPolicy"
            Effect: "Allow"
            Resource:
              Fn::Join: ["",["arn:aws:logs:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId", ":log-group:/aws/codebuild/", !Ref "CodeBuildProjectName", "*"]]
            Action:
              - "logs:CreateLogGroup"
              - "logs:CreateLogStream"
              - "logs:PutLogEvents"
          - 
            Sid: S3AccessPolicy
            Effect: "Allow"
            Action:
              - "s3:GetObject"
              - "s3:GetObjectVersion"
              - "s3:GetBucketVersioning"
            Resource: "*"
          - 
            Sid: S3WritePolicy
            Effect: "Allow"
            Action: ["s3:PutObject"]
            Resource: 
              Fn::Join: ["",[!GetAtt [PipleineArtifactBucket, Arn], "*"]]
          -
            Sid: ECRAuthroizationPolicy
            Effect: "Allow"
            Action:
              - "ecr:GetAuthorizationToken"
            Resource: "*"
          - 
            Sid: ECRPolicy
            Effect: "Allow"
            Action: 
              - "ecr:GetAuthorizationToken"
              - "ecr:BatchCheckLayerAvailability"
              - "ecr:GetDownloadUrlForLayer"
              - "ecr:GetRepositoryPolicy"
              - "ecr:DescribeRepositories"
              - "ecr:ListImages"
              - "ecr:DescribeImages"
              - "ecr:BatchGetImage"
              - "ecr:InitiateLayerUpload"
              - "ecr:UploadLayerPart"
              - "ecr:CompleteLayerUpload"
              - "ecr:PutImage"
            Resource: !Ref EcrRepositoryArn
  CodeBuildProject:
    Type: "AWS::CodeBuild::Project"
    DependsOn: CodeBuildServiceRolePolicy
    Properties:
      Name: !Ref CodeBuildProjectName
      Description: "Container DevSecOps using Anchore Engine Inline Scan Warpper Shell"
      Source:
        Type: CODEPIPELINE
        InsecureSsl: false
      Environment:
        Type: LINUX_CONTAINER
        Image: "aws/codebuild/docker:17.09.0"
        ComputeType: "BUILD_GENERAL1_SMALL"
        PrivilegedMode: true
        EnvironmentVariables:
          - 
            Name: ECR_REPOSITORY_URI
            Value: !Ref EcrRepositoryUri
            Type: PLAINTEXT
      ServiceRole: !Ref CodeBuildServiceRole
      Artifacts:
        Type: CODEPIPELINE
        NamespaceType: NONE
        Name: !Ref CodeBuildProjectName
        Packaging: NONE
      Cache:
        Type: 'NO_CACHE'
  CodePipelineServiceRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action: "sts:AssumeRole"
            Principal:
              Service: "codepipeline.amazonaws.com"
  CodePipelineServiceRolePolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      Roles: [!Ref CodePipelineServiceRole]
      PolicyName: CodePipelineTrustPolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - 
            Sid: S3AccessPolicy
            Effect: "Allow"
            Action:
              - "s3:GetObject"
              - "s3:GetObjectVersion"
              - "s3:GetBucketVersioning"
            Resource: "*"
          - 
            Sid: S3WritePolicy
            Effect: "Allow"
            Action: ["s3:PutObject"]
            Resource: 
              Fn::Join: ["",[!GetAtt [PipleineArtifactBucket, Arn], "*"]]
          - 
            Sid: CodeCommitPolicy
            Effect: "Allow"
            Action:
              - "codecommit:CancelUploadArchive"
              - "codecommit:GetBranch"
              - "codecommit:GetCommit"
              - "codecommit:GetUploadArchiveStatus"
              - "codecommit:UploadArchive"
            Resource: "*"
          - 
            Sid: EcsPolicy
            Effect: "Allow"
            Action: ["ecs:*"]
            Resource: "*"
          -
            Sid: IamPolicy
            Effect: "Allow"
            Action: ["iam:PassRole"]
            Resource: "*"
          - 
            Sid: CodeBuildPolicy
            Effect: "Allow"
            Action:
              - "codebuild:BatchGetBuilds"
              - "codebuild:StartBuild"
            Resource: !GetAtt [CodeBuildProject, Arn]
  CodePipeline:
    Type: "AWS::CodePipeline::Pipeline"
    DependsOn: CodePipelineServiceRolePolicy
    Properties:
      ArtifactStore:
        Type: S3
        Location: !Ref PipleineArtifactBucket
      RoleArn: !GetAtt [CodePipelineServiceRole, Arn]
      Stages:
        - 
          Name: Source
          Actions:
            - 
              Name: "Source"
              ActionTypeId: 
                Category: "Source"
                Owner: AWS
                Provider: CodeCommit
                Version: "1"
              RunOrder: 1
              Configuration:
                BranchName: "master"
                PollForSourceChanges: false
                RepositoryName:
                  !Ref ApacheWebsiteCodeCommitRepoName
              OutputArtifacts:
                - Name: "MyApp"
        - 
          Name: "Build"
          Actions:
            - 
              Name: "CodeBuild"
              ActionTypeId: 
                Category: "Build"
                Owner: AWS
                Provider: CodeBuild
                Version: "1"
              RunOrder: 1
              Configuration:
                ProjectName: !Ref CodeBuildProjectName
              OutputArtifacts:
                - Name: "MyAppBuild"
              InputArtifacts:
                - Name: "MyApp"
        -
          Name: Staging
          Actions:
            - 
              Name: !Ref EcsServiceName
              ActionTypeId:
                Category: "Deploy"
                Owner: AWS
                Provider: ECS
                Version: "1"
              RunOrder: 1
              Configuration:
                ClusterName: !Ref ECSClusterName
                FileName: "imagedefinitions.json"
                ServiceName: !Ref EcsServiceName
              InputArtifacts:
                - Name: "MyAppBuild"
  EventsServiceRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action: "sts:AssumeRole"
            Principal:
              Service: "events.amazonaws.com"
  EventsServiceRolePolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      Roles: [!Ref EventsServiceRole]
      PolicyName: EventsTrustPolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - 
            Sid: "CodePipelinePolicy"
            Effect: "Allow"
            Resource:
              Fn::Join: ["",["arn:aws:codepipeline:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId", ":", !Ref CodePipeline]]
            Action:
              - "codepipeline:StartPipelineExecution"
  CodePipelineEventTrigger:
    Type: "AWS::Events::Rule"
    DependsOn: EventsServiceRolePolicy
    Properties:
      Description: "Amazon CloudWatch Events rule to automatically start your pipeline when a change occurs in the AWS CodeCommit source repository and branch."
      State: ENABLED
      EventPattern:
        source:
          - "aws.codecommit"
        detail-type:
          - "CodeCommit Repository State Change"
        resources:
          - !Ref ApacheWebsiteCodeCommitRepoArn
        detail:
          event:
            - "referenceCreated"
            - "referenceUpdated"
          referenceType:
            - "branch"
          referenceName:
            - "master"
      Targets:
        - 
          Id: "TargetCodePipeline"
          Arn: 
            Fn::Join: ["",["arn:aws:codepipeline:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId", ":", !Ref CodePipeline]]
          RoleArn: !GetAtt [EventsServiceRole, Arn]
Outputs:
  CodePipelineName:
    Description: CodePipeline Name
    Value: !Ref CodePipeline
  PipleineArtifactBucketName:
    Description: Pipleine Artifact Bucket Name
    Value: !Ref PipleineArtifactBucket