cicd.template.yml

Description: CICD pipeline for Cythral Icons
Parameters: 
  GithubToken: 
    Type: String 
    NoEcho: true
    Default: ""
    Description: OAuth token for the Github organization.  Needs read/write access to repos and repo hooks

  GithubOwner:
    Type: String
    Description: Owner of the github repository to track

  GithubRepo:
    Type: String
    Description: Name of the github repository to track

  GithubBranch:
    Type: String
    Default: ""
    Description: Name of the github branch to track

Resources:
  ArtifactStore:
    Type: AWS::S3::Bucket

  TestBucket:
    Type: AWS::S3::Bucket

  ArtifactStorePolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ArtifactStore
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: s3:*Object
            Resource:
              - !Sub arn:aws:s3:::${ArtifactStore}
              - !Sub arn:aws:s3:::${ArtifactStore}/*
            Principal:
              AWS:
                - !Ref AWS::AccountId
                - !ImportValue cfn-metadata:DevAgentRoleArn
                - !ImportValue cfn-metadata:ProdAgentRoleArn
  
  BuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub ${AWS::StackName}-build
      BadgeEnabled: true
      ServiceRole: !ImportValue cfn-utilities:BuilderRoleArn
      EncryptionKey: !ImportValue cfn-utilities:ArtifactKeyArn
      Environment:
        PrivilegedMode: true
        Image: aws/codebuild/amazonlinux2-x86_64-standard:2.0
        ComputeType: BUILD_GENERAL1_SMALL
        EnvironmentVariables:
          - Name: ARTIFACT_STORE
            Value: !Ref ArtifactStore
        Type: LINUX_CONTAINER
      Cache:
        Type: LOCAL
        Modes:
          - LOCAL_DOCKER_LAYER_CACHE
      Artifacts:
        Type: NO_ARTIFACTS
      SecondaryArtifacts:
        - ArtifactIdentifier: buildResults
          Type: S3
          Location: !Ref ArtifactStore
          Name: buildResults.zip
          NamespaceType: BUILD_ID
          Packaging: ZIP
        - ArtifactIdentifier: siteFiles
          Type: S3
          Location: !Ref ArtifactStore
          Name: siteFiles.zip
          NamespaceType: BUILD_ID
          Packaging: ZIP
      Source:
        Type: GITHUB
        Location: !Sub https://github.com/${GithubOwner}/${GithubRepo}.git
        ReportBuildStatus: true

  SupersessionQueue:
    Type: AWS::SQS::Queue
    Properties:
      ContentBasedDeduplication: true
      FifoQueue: true
      MessageRetentionPeriod: 1209600 

  SupersessionEventSourceMapping:
    Type: AWS::Lambda::EventSourceMapping
    Properties:
      FunctionName: !ImportValue cfn-core:DeploymentSupersessionFunctionArn
      EventSourceArn: !GetAtt SupersessionQueue.Arn

  DeploymentQueue:
    Type: AWS::SQS::Queue
    Properties:
      ContentBasedDeduplication: true
      VisibilityTimeout: 3600
      FifoQueue: true
      MessageRetentionPeriod: 1209600

  DeploymentEventSourceMapping:
    Type: AWS::Lambda::EventSourceMapping
    Properties:
      FunctionName: !ImportValue cfn-core:StackDeploymentFunctionArn
      EventSourceArn: !GetAtt DeploymentQueue.Arn

  StateMachine:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      RoleArn: !ImportValue cfn-utilities:MasterRoleArn
      StateMachineName: !Sub ${AWS::StackName}-pipeline
      DefinitionString: !Sub
        - |
          {
            "StartAt": "Build",
            "States": {
              "Build": {
                "Type": "Task",
                "Resource": "arn:aws:states:::codebuild:startBuild.sync",
                "Parameters": {
                  "ProjectName": "${BuildProject}",
                  "SourceVersion.$": "$.head_commit.id"
                },
                "ResultPath": "$.BuildOutput",
                "Next": "On Default Branch?"
              },
              "On Default Branch?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.on_default_branch",
                    "BooleanEquals": true,
                    "Next": "Check if Superseded"
                  },
                  {
                    "Variable": "$.on_default_branch",
                    "BooleanEquals": false,
                    "Next": "Success"
                  } 
                ]
              },
              "Check if Superseded": {
                "Type": "Task",
                "Resource": "arn:aws:states:::sqs:sendMessage.waitForTaskToken",
                "ResultPath": "$.SupersededOutput",
                "Next": "Was Superseded?",
                "Parameters": {
                  "QueueUrl": "${SupersessionQueue}",
                  "MessageGroupId": "${GithubRepo}",
                  "MessageBody": {
                    "Pipeline": "${GithubRepo}",
                    "CommitTimestamp.$": "$.head_commit.timestamp",
                    "Token.$": "$$.Task.Token"
                  }
                }
              },
              "Was Superseded?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.SupersededOutput.Superseded",
                    "BooleanEquals": true,
                    "Next": "Success"
                  },
                  {
                    "Variable": "$.SupersededOutput.Superseded",
                    "BooleanEquals": false,
                    "Next": "Deploy to Dev"
                  }
                ]
              },
              "Deploy to Dev": {
                "Type": "Task",
                "Resource": "arn:aws:states:::sqs:sendMessage.waitForTaskToken",
                "ResultPath": "$.DevOutputs",
                "Parameters": {
                  "QueueUrl": "${DeploymentQueue}",
                  "MessageGroupId": "${GithubRepo}-dev",
                  "MessageBody": {
                    "StackName": "${GithubRepo}",
                    "ZipLocation.$": "$.BuildOutput.Build.SecondaryArtifacts[0].Location",
                    "TemplateFileName": "${GithubRepo}.template.yml",
                    "TemplateConfigurationFileName": "${GithubRepo}.dev.config.json",
                    "RoleArn": "${DevRoleArn}",
                    "Token.$": "$$.Task.Token",
                    "Capabilities": ["CAPABILITY_IAM"],
                    "EnvironmentName": "dev",
                    "CommitInfo": {
                      "GithubOwner": "${GithubOwner}",
                      "GithubRepository": "${GithubRepo}",
                      "GithubRef.$": "$.head_commit.id"
                    }
                  }
                },
                "Next": "Upload Dev Files"
              },
              "Upload Dev Files": {
                "Type": "Task",
                "Resource": "${S3DeploymentFunctionArn}",
                "ResultPath": null,
                "Parameters": {
                  "ZipLocation.$": "$.BuildOutput.Build.SecondaryArtifacts[1].Location",
                  "DestinationBucket": "icons.dev.cythral.com",
                  "RoleArn": "${DevRoleArn}",
                  "EnvironmentName": "dev",
                  "ProjectName": "${GithubRepo}",
                  "CommitInfo": {
                    "GithubOwner": "${GithubOwner}",
                    "GithubRepository": "${GithubRepo}",
                    "GithubRef.$": "$.head_commit_id"
                  }
                },
                "Next": "Ask for Approval"
              },
              "Ask for Approval": {
                "Type": "Task",
                "Resource": "arn:aws:states:::lambda:invoke.waitForTaskToken",
                "Next": "Was Approved?",
                "ResultPath": "$.ApprovalDecision",
                "Parameters": {
                  "FunctionName": "${ApprovalNotificationFunction}",
                  "Payload": {
                    "Pipeline": "${GithubRepo}",
                    "ArtifactStore": "${ArtifactStore}",
                    "CustomMessage": "${GithubRepo} requires manual approval for deployment to production",
                    "Token.$": "$$.Task.Token"
                  }
                }
              },
              "Was Approved?": {
                "Type": "Choice",
                "Choices": [
                  {
                    "Variable": "$.ApprovalDecision.Action",
                    "StringEquals": "approve",
                    "Next": "Deploy to Prod"
                  },
                  {
                    "Variable": "$.ApprovalDecision.Action",
                    "StringEquals": "reject",
                    "Next": "Success"
                  }
                ]
              },
              "Deploy to Prod": {
                "Type": "Task",
                "Resource": "arn:aws:states:::sqs:sendMessage.waitForTaskToken",
                "ResultPath": "$.ProdOutputs",
                "Parameters": {
                  "QueueUrl": "${DeploymentQueue}",
                  "MessageGroupId": "${GithubRepo}-prod",
                  "MessageBody": {
                    "StackName": "${GithubRepo}",
                    "ZipLocation.$": "$.BuildOutput.Build.SecondaryArtifacts[0].Location",
                    "TemplateFileName": "${GithubRepo}.template.yml",
                    "TemplateConfigurationFileName": "${GithubRepo}.prod.config.json",
                    "RoleArn": "${ProdRoleArn}",
                    "Token.$": "$$.Task.Token",
                    "Capabilities": ["CAPABILITY_IAM"],
                    "EnvironmentName": "prod",
                    "CommitInfo": {
                      "GithubOwner": "${GithubOwner}",
                      "GithubRepository": "${GithubRepo}",
                      "GithubRef.$": "$.head_commit.id"
                    }
                  }
                },
                "Next": "Upload Prod Files"
              },
              "Upload Prod Files": {
                "Type": "Task",
                "Resource": "${S3DeploymentFunctionArn}",
                "ResultPath": null,
                "Parameters": {
                  "ZipLocation.$": "$.BuildOutput.Build.SecondaryArtifacts[1].Location",
                  "DestinationBucket": "icons.cythral.com",
                  "RoleArn": "${ProdRoleArn}",
                  "EnvironmentName": "prod",
                  "ProjectName": "${GithubRepo}",
                  "CommitInfo": {
                    "GithubOwner": "${GithubOwner}",
                    "GithubRepository": "${GithubRepo}",
                    "GithubRef.$": "$.head_commit.id"
                  }
                },
                "Next": "Deploy DNS"
              },
              "Deploy DNS": {
                "Type": "Task",
                "Resource": "arn:aws:states:::sqs:sendMessage.waitForTaskToken",
                "ResultPath": null,
                "Parameters": {
                  "QueueUrl": "${DeploymentQueue}",
                  "MessageGroupId": "${GithubRepo}-dns",
                  "MessageBody": {
                    "StackName": "icons-dns",
                    "ZipLocation.$": "$.BuildOutput.Build.SecondaryArtifacts[0].Location",
                    "TemplateFileName": "dns.template.yml",
                    "RoleArn": "${SharedRoleArn}",
                    "Token.$": "$$.Task.Token",
                    "ParameterOverrides": {
                      "HostedZone": "cythral.com.",
                      "DevDomainName.$": "$.DevOutputs.DomainName",
                      "DevAliasTarget.$": "$.DevOutputs.CloudfrontDomainName",
                      "ProdDomainName.$": "$.ProdOutputs.DomainName",
                      "ProdAliasTarget.$": "$.ProdOutputs.CloudfrontDomainName"
                    },
                    "Capabilities": ["CAPABILITY_IAM"],
                    "EnvironmentName": "shared",
                    "CommitInfo": {
                      "GithubOwner": "${GithubOwner}",
                      "GithubRepository": "${GithubRepo}",
                      "GithubRef.$": "$.head_commit.id"
                    }
                  }
                },
                "Next": "Success"
              },
              "Success": {
                "Type": "Succeed"
              }
            }
          }
        - # Roles
          DevRoleArn: !ImportValue cfn-metadata:DevAgentRoleArn
          ProdRoleArn: !ImportValue cfn-metadata:ProdAgentRoleArn
          SharedRoleArn: !ImportValue cfn-utilities:MasterRoleArn

          # Functions
          ApprovalNotificationFunction: cfn-core-ApprovalNotificationFunction-14V53I9N6Z2YZ
          S3DeploymentFunctionArn: !ImportValue cfn-core:S3DeploymentFunctionArn