cicd.template.yml

Description: CICD pipeline for Dotnet Lambda Layer
Parameters:
  GithubToken:
    Type: String
    NoEcho: true
    Default: ""
    Description: OAuth token for the Github organization.  Needs read/write access to repos and repo hooks

  GithubOwner:
    Type: String
    Description: Owner of the github repository to track

  GithubRepo:
    Type: String
    Description: Name of the github repository to track

  GithubBranch:
    Type: String
    Default: ""
    Description: Name of the github branch to track

  PipelineDefinitionBucket:
    Type: String
    Description: Bucket name where the pipeline definition is located

  PipelineDefinitionKey:
    Type: String
    Description: Key name where the pipeline definition is located

Resources:
  ArtifactStore:
    Type: AWS::S3::Bucket

  ArtifactStorePolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ArtifactStore
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: s3:*Object
            Resource:
              - !Sub arn:aws:s3:::${ArtifactStore}
              - !Sub arn:aws:s3:::${ArtifactStore}/*
            Principal:
              AWS:
                - !Ref AWS::AccountId
                - !ImportValue cfn-metadata:DevAgentRoleArn
                - !ImportValue cfn-metadata:ProdAgentRoleArn
          - Effect: Allow
            Action: s3:GetObject
            Resource:
              - !Sub arn:aws:s3:::${ArtifactStore}/templates/*
            Principal:
              Service: serverlessrepo.amazonaws.com

  BuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub ${AWS::StackName}-build
      BadgeEnabled: true
      ServiceRole: !ImportValue cfn-utilities:BuilderRoleArn
      EncryptionKey: !ImportValue cfn-utilities:ArtifactKeyArn
      Environment:
        PrivilegedMode: true
        Image: aws/codebuild/amazonlinux2-x86_64-standard:3.0
        ComputeType: BUILD_GENERAL1_SMALL
        EnvironmentVariables:
          - Name: ARTIFACT_STORE
            Value: !Ref ArtifactStore
        Type: LINUX_CONTAINER
      Cache:
        Type: LOCAL
        Modes:
          - LOCAL_DOCKER_LAYER_CACHE
      Artifacts:
        Type: S3
        Location: !Ref ArtifactStore
        Name: buildResults.zip
        NamespaceType: BUILD_ID
        Packaging: ZIP
      Source:
        Type: GITHUB
        Location: !Sub https://github.com/${GithubOwner}/${GithubRepo}.git
        ReportBuildStatus: true

  DeployProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub ${AWS::StackName}-deploy
      BadgeEnabled: true
      ServiceRole: !ImportValue cfn-utilities:BuilderRoleArn
      EncryptionKey: !ImportValue cfn-utilities:ArtifactKeyArn
      Environment:
        Image: aws/codebuild/amazonlinux2-x86_64-standard:3.0
        ComputeType: BUILD_GENERAL1_SMALL
        EnvironmentVariables:
          - Name: ARTIFACT_STORE
            Value: !Ref ArtifactStore
          - Name: ROLE_ARN
            Value: !ImportValue cfn-metadata:OssServerlessPublisherRoleArn
        Type: LINUX_CONTAINER
      Cache:
        Type: LOCAL
        Modes:
          - LOCAL_DOCKER_LAYER_CACHE
      Artifacts:
        Type: NO_ARTIFACTS
      Source:
        Type: GITHUB
        Location: !Sub https://github.com/${GithubOwner}/${GithubRepo}.git
        ReportBuildStatus: true
        BuildSpec: deployspec.yml

  SupersessionQueue:
    Type: AWS::SQS::Queue
    Properties:
      ContentBasedDeduplication: true
      FifoQueue: true
      MessageRetentionPeriod: 1209600

  SupersessionEventSourceMapping:
    Type: AWS::Lambda::EventSourceMapping
    Properties:
      FunctionName: !ImportValue cfn-core:DeploymentSupersessionFunctionArn
      EventSourceArn: !GetAtt SupersessionQueue.Arn

  DeploymentQueue:
    Type: AWS::SQS::Queue
    Properties:
      ContentBasedDeduplication: true
      VisibilityTimeout: 3600
      FifoQueue: true
      MessageRetentionPeriod: 1209600

  DeploymentEventSourceMapping:
    Type: AWS::Lambda::EventSourceMapping
    Properties:
      FunctionName: !ImportValue cfn-core:StackDeploymentFunctionArn
      EventSourceArn: !GetAtt DeploymentQueue.Arn

  StateMachine:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      RoleArn: !ImportValue cfn-utilities:MasterRoleArn
      StateMachineName: !Sub ${AWS::StackName}-pipeline
      DefinitionS3Location:
        Bucket: !Ref PipelineDefinitionBucket
        Key: !Ref PipelineDefinitionKey
      DefinitionSubstitutions:
        GithubRepo: !Ref GithubRepo
        GithubOwner: !Ref GithubOwner
        ArtifactStore: !Ref ArtifactStore
        BuildProject: !Ref BuildProject
        DeployProject: !Ref DeployProject
        DeploymentQueue: !Ref DeploymentQueue
        SupersessionQueue: !Ref SupersessionQueue
        OssRoleArn: !ImportValue cfn-metadata:OssAgentRoleArn
        DevRoleArn: !ImportValue cfn-metadata:DevAgentRoleArn
        ProdRoleArn: !ImportValue cfn-metadata:ProdAgentRoleArn
        SharedRoleArn: !ImportValue cfn-utilities:MasterRoleArn
        ApprovalNotificationFunction: !ImportValue cfn-core:ApprovalNotificationFunctionArn
    Metadata: 
      cfn-lint:
        config:
          ignore_checks:
            - E3002
            - E3003