cloudformation.yml

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  GitHubOwner:
    Type: String
    Description: GitHub repository owner
  GitHubRepo:
    Type: String
    Default: aws-codepipeline-nested-stack
    Description: GitHub repository name
  GitHubToken:
    Type: String
    Description: GitHub repository OAuth token
  ProjectName:
    Type: String
    Description: Project Name
  ArtifactsBucket:
    Type: String
    Description: Artifacts bucket Name
Resources:

  #
  # CloudFormation IAM Role
  #
  CloudFormationRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - cloudformation.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess

  #
  # Role that our Lambda will assume to provide access to other AWS resources
  #
  IamRoleLambdaExecution:
    Type: AWS::IAM::Role
    DependsOn: CloudFormationRole
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: '/'

  #
  # Create a Policy and attach it to our Lambda Role.
  #
  IamPolicyLambdaExecution:
    Type: AWS::IAM::Policy
    DependsOn: CloudFormationRole
    Properties:
      PolicyName: IamPolicyLambdaExecution
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
          Resource: arn:aws:logs:us-east-1:*:*
        - Effect: Allow
          Action:
            - logs:PutLogEvents
          Resource: arn:aws:logs:us-east-1:*:*
        - Effect: Allow
          Action:
            - codepipeline:PutJobSuccessResult
            - codepipeline:PutJobFailureResult
          Resource: '*'
        - Effect: Allow
          Action:
            - s3:GetObject
            - s3:GetObjectVersion
            - s3:ListBucket
            - s3:PutObject
          Resource: '*'
        - Effect: Allow
          Action:
            - lambda:UpdateFunctionCode
            - lambda:UpdateAlias
            - lambda:ListAliases
            - lambda:ListVersionsByFunction
            - lambda:DeleteFunction
          Resource: '*'
      Roles:
      - Ref: IamRoleLambdaExecution

  #
  # Our Lambda function.  Basic code has been added.  You will replace the code later via your Github repo.
  #
  APIFunction:
    Type: AWS::Lambda::Function
    DependsOn: CloudFormationRole
    Properties:
      Handler: index.handler
      Timeout: 5
      Role:
        Fn::GetAtt:
          - IamRoleLambdaExecution
          - Arn
      Code:
        S3Bucket: !Ref ArtifactsBucket
        S3Key: 'index.js.zip'
      Runtime: nodejs6.10

  #
  # Create two aliases for our Lambda function.  DEV and PROD.  These pointers may point to different versions of the
  # function.  This allows us to try out new code in our dev environment before promoting it to prod.
  #
  APIFunctionDevAlias:
    Type: AWS::Lambda::Alias
    DependsOn: CloudFormationRole
    Properties:
      FunctionName:
        Ref: APIFunction
      FunctionVersion: '$LATEST'
      Name: DEV
  APIFunctionProdAlias:
    Type: AWS::Lambda::Alias
    DependsOn: CloudFormationRole
    Properties:
      FunctionName:
        Ref: APIFunction
      FunctionVersion: '$LATEST'
      Name: PROD

  #
  # We need to give API Gateway permission to invoke our Lambda function and aliases.
  #
  LambdaDevPermission:
    Type: AWS::Lambda::Permission
    DependsOn: CloudFormationRole
    Properties:
      Action: lambda:invokeFunction
      FunctionName:
        Ref: APIFunctionDevAlias
      Principal: apigateway.amazonaws.com
      SourceArn:
        Fn::Join:
          - ''
          - - 'arn:aws:execute-api:'
            - Ref: AWS::Region
            - ':'
            - Ref: AWS::AccountId
            - ':'
            - Ref: ApiGatewayRestApi
            - '/*/*'
  LambdaProdPermission:
    Type: AWS::Lambda::Permission
    DependsOn: CloudFormationRole
    Properties:
      Action: lambda:invokeFunction
      FunctionName:
        Ref: APIFunctionProdAlias
      Principal: apigateway.amazonaws.com
      SourceArn:
        Fn::Join:
          - ''
          - - 'arn:aws:execute-api:'
            - Ref: AWS::Region
            - ':'
            - Ref: AWS::AccountId
            - ':'
            - Ref: ApiGatewayRestApi
            - '/*/*'

  #
  # Create the API Gateway
  #
  ApiGatewayRestApi:
    Type: AWS::ApiGateway::RestApi
    DependsOn: CloudFormationRole
    Properties:
      Name: ApiGatewayRestApi
  ApiGatewayResource:
    Type: AWS::ApiGateway::Resource
    DependsOn: CloudFormationRole
    Properties:
      ParentId:
        Fn::GetAtt:
          - ApiGatewayRestApi
          - RootResourceId
      PathPart: api
      RestApiId:
        Ref: ApiGatewayRestApi
  ApiGatewayResourceProxy:
    Type: AWS::ApiGateway::Resource
    DependsOn: CloudFormationRole
    Properties:
      ParentId:
        Ref: ApiGatewayResource
      PathPart: '{proxy+}'
      RestApiId:
        Ref: ApiGatewayRestApi

  #
  # Create a role that gives API Gateway permission to write to CloudWatch Logs.
  #
  ApiGatewayCloudWatchLogsRole:
    Type: AWS::IAM::Role
    DependsOn: CloudFormationRole
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - apigateway.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
      - PolicyName: ApiGatewayLogsPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:DescribeLogGroups
            - logs:DescribeLogStreams
            - logs:PutLogEvents
            - logs:GetLogEvents
            - logs:FilterLogEvents
            Resource: "*"

  #
  # Attach the role to API Gateway
  #
  ApiGatewayAccount:
    Type: AWS::ApiGateway::Account
    DependsOn: CloudFormationRole
    Properties:
      CloudWatchRoleArn:
        Fn::GetAtt:
          - ApiGatewayCloudWatchLogsRole
          - Arn

  #
  # Create an API Gateway stage that invokes either the DEV or PROD Lambda alias.  This allows us to have different
  # api endpoints, one for dev and one for prod.
  #
  ApiGatewayStageDEV:
    DependsOn:
    - ApiGatewayAccount
    - CloudFormationRole
    Type: AWS::ApiGateway::Stage
    Properties:
      DeploymentId:
        Ref: ApiGatewayDeployment
      MethodSettings:
      - DataTraceEnabled: true
        HttpMethod: "*"
        LoggingLevel: INFO
        ResourcePath: "/*"
      RestApiId:
        Ref: ApiGatewayRestApi
      StageName: dev
      Variables:
        LambdaAlias: DEV
  ApiGatewayStagePROD:
    DependsOn:
    - ApiGatewayAccount
    - CloudFormationRole
    Type: AWS::ApiGateway::Stage
    Properties:
      DeploymentId:
        Ref: ApiGatewayDeployment
      MethodSettings:
      - DataTraceEnabled: true
        HttpMethod: "*"
        LoggingLevel: INFO
        ResourcePath: "/*"
      RestApiId:
        Ref: ApiGatewayRestApi
      StageName: prod
      Variables:
        LambdaAlias: PROD

  #
  # Create a GET and POST method that each invoke our Lambda
  #
  ApiGatewayMethod:
    Type: AWS::ApiGateway::Method
    DependsOn: CloudFormationRole
    Properties:
      HttpMethod: ANY
      RequestParameters: {}
      ResourceId:
        Ref: ApiGatewayResource
      RestApiId:
        Ref: ApiGatewayRestApi
      AuthorizationType: NONE
      Integration:
        IntegrationHttpMethod: POST
        Type: AWS_PROXY
        Uri:
          Fn::Join:
            - ''
            - - 'arn:aws:apigateway:'
              - Ref: AWS::Region
              - ':lambda:path/2015-03-31/functions/'
              - Fn::GetAtt:
                - APIFunction
                - Arn
              - ':${stageVariables.LambdaAlias}'
              - '/invocations'
      MethodResponses: []
  ApiGatewayMethoProxy:
    Type: AWS::ApiGateway::Method
    DependsOn: CloudFormationRole
    Properties:
      HttpMethod: ANY
      RequestParameters: {}
      ResourceId:
        Ref: ApiGatewayResourceProxy
      RestApiId:
        Ref: ApiGatewayRestApi
      AuthorizationType: NONE
      Integration:
        IntegrationHttpMethod: POST
        Type: AWS_PROXY
        Uri:
          Fn::Join:
            - ''
            - - 'arn:aws:apigateway:'
              - Ref: AWS::Region
              - ':lambda:path/2015-03-31/functions/'
              - Fn::GetAtt:
                - APIFunction
                - Arn
              - ':${stageVariables.LambdaAlias}'
              - '/invocations'
      MethodResponses: []

  ApiGatewayMethodOptions:
    Type: AWS::ApiGateway::Method
    Properties:
      AuthorizationType: NONE
      ResourceId:
        Ref: ApiGatewayResourceProxy
      RestApiId:
        Ref: ApiGatewayRestApi
      HttpMethod: OPTIONS
      Integration:
        IntegrationResponses:
        - StatusCode: 200
          ResponseParameters:
            method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
            method.response.header.Access-Control-Allow-Methods: "'POST,OPTIONS'"
            method.response.header.Access-Control-Allow-Origin: "'*'"
          ResponseTemplates:
            application/json: ''
        PassthroughBehavior: WHEN_NO_MATCH
        RequestTemplates:
          application/json: '{"statusCode": 200}'
        Type: MOCK
      MethodResponses:
      - StatusCode: 200
        ResponseModels:
          application/json: 'Empty'
        ResponseParameters:
            method.response.header.Access-Control-Allow-Headers: false
            method.response.header.Access-Control-Allow-Methods: false
            method.response.header.Access-Control-Allow-Origin: false

  #
  # Create the API Gateway deployment which uses both the GET and POST methods
  #
  ApiGatewayDeployment:
    Type: AWS::ApiGateway::Deployment
    DependsOn: CloudFormationRole
    Properties:
      RestApiId:
        Ref: ApiGatewayRestApi
      StageName: DummyStage
    DependsOn:
    - ApiGatewayMethod
    - ApiGatewayMethoProxy


  #
  # CI/CD CodePipeline
  #

  #
  # Code Build IAM Role
  #
  CodeBuildRole:
    Type: AWS::IAM::Role
    DependsOn: CloudFormationRole
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - codebuild.amazonaws.com
      Policies:
        - PolicyName: ServiceRole
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: CloudWatchWriteLogsPolicy
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: '*'
              - Sid: S3GetObjectPolicy
                Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:GetObjectVersion
                Resource: '*'
              - Sid: S3PutObjectPolicy
                Effect: Allow
                Action:
                  - s3:PutObject
                Resource: '*'

  #
  # Code Pipeline IAM Role
  #
  CodePipelineRole:
    Type: AWS::IAM::Role
    DependsOn: CloudFormationRole
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - codepipeline.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess

  #
  # Code Build project
  #
  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    DependsOn: CloudFormationRole
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/eb-nodejs-6.10.0-amazonlinux-64:4.0.0
        Type: LINUX_CONTAINER
      Name:
        Fn::Join:
          - ''
          - - Ref: ProjectName
            - '-code-build'
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Source:
        Type: CODEPIPELINE
        BuildSpec: api/buildspec.yml
      TimeoutInMinutes: 5 # must be between 5 minutes and 8 hours

  #
  # Package Lambda function.  Last step in the CodePipeline
  #
  PackageFunction:
    Type: AWS::Lambda::Function
    DependsOn: CloudFormationRole
    Properties:
      Handler: package.handler
      Timeout: 5
      Role:
        Fn::GetAtt:
          - IamRoleLambdaExecution
          - Arn
      Code:
        S3Bucket: !Ref ArtifactsBucket
        S3Key: 'package.js.zip'
      Runtime: nodejs6.10

  #
  # Package Lambda function.  Last step in the CodePipeline
  #
  DeployFunction:
    Type: AWS::Lambda::Function
    DependsOn: CloudFormationRole
    Properties:
      Handler: deploy.deploy
      Timeout: 5
      Role:
        Fn::GetAtt:
          - IamRoleLambdaExecution
          - Arn
      Code:
        S3Bucket: !Ref ArtifactsBucket
        S3Key: 'deploy.js.zip'
      Runtime: nodejs6.10
  ShowFunction:
    Type: AWS::Lambda::Function
    DependsOn: CloudFormationRole
    Properties:
      Handler: deploy.show
      Timeout: 5
      Role:
        Fn::GetAtt:
          - IamRoleLambdaExecution
          - Arn
      Code:
        S3Bucket: !Ref ArtifactsBucket
        S3Key: 'deploy.js.zip'
      Runtime: nodejs6.10

  #
  # Code Pipeline 'master'
  #
  CodePipelineMaster:
    Type: AWS::CodePipeline::Pipeline
    DependsOn: CloudFormationRole
    Properties:
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactsBucket
      RestartExecutionOnUpdate: true
      RoleArn: !GetAtt CodePipelineRole.Arn
      Stages:
      - Name: Source
        Actions:
        - Name: Source
          ActionTypeId:
            Category: Source
            Owner: ThirdParty
            Version: 1
            Provider: GitHub
          Configuration:
            Owner: !Ref GitHubOwner
            Repo: !Ref GitHubRepo
            Branch: 'master'
            OAuthToken: !Ref GitHubToken
          OutputArtifacts:
            - Name: SourceOutput
          RunOrder: 1
      - Name: StackDeploy
        Actions:
          - Name: CreateUpdateStack
            ActionTypeId:
              Category: Deploy
              Owner: AWS
              Provider: CloudFormation
              Version: 1
            Configuration:
              ActionMode: CREATE_UPDATE
              Capabilities: CAPABILITY_IAM
              RoleArn: !GetAtt CloudFormationRole.Arn
              StackName: !Ref AWS::StackName
              TemplatePath: SourceOutput::infrastructure/cloudformation.yml
              ParameterOverrides: !Sub |
                {
                  "GitHubOwner": "${GitHubOwner}",
                  "GitHubRepo": "${GitHubRepo}",
                  "GitHubToken": "${GitHubToken}",
                  "ArtifactsBucket": "${ArtifactsBucket}",
                  "ProjectName": "${ProjectName}"
                }
            InputArtifacts:
              - Name: SourceOutput
      - Name: Build
        Actions:
          - Name: BuildAndTest
            ActionTypeId:
              Category: Build
              Owner: AWS
              Provider: CodeBuild
              Version: 1
            Configuration:
              ProjectName: !Ref CodeBuildProject
            InputArtifacts:
              - Name: SourceOutput
            OutputArtifacts:
              - Name: BuildOutput
      - Name: Package
        Actions:
          - Name: Package
            ActionTypeId:
              Category: Invoke
              Owner: AWS
              Provider: Lambda
              Version: 1
            InputArtifacts:
              - Name: BuildOutput
              - Name: SourceOutput
            Configuration:
              FunctionName: !Ref PackageFunction
              UserParameters: 'master'

  #
  # Code Pipeline 'develop'
  #
  CodePipelineDevelop:
    Type: AWS::CodePipeline::Pipeline
    DependsOn: CloudFormationRole
    Properties:
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactsBucket
      RestartExecutionOnUpdate: true
      RoleArn: !GetAtt CodePipelineRole.Arn
      Stages:
      - Name: Source
        Actions:
        - Name: Source
          ActionTypeId:
            Category: Source
            Owner: ThirdParty
            Version: 1
            Provider: GitHub
          Configuration:
            Owner: !Ref GitHubOwner
            Repo: !Ref GitHubRepo
            Branch: 'develop'
            OAuthToken: !Ref GitHubToken
          OutputArtifacts:
            - Name: SourceOutput
          RunOrder: 1
      - Name: Build
        Actions:
          - Name: BuildAndTest
            ActionTypeId:
              Category: Build
              Owner: AWS
              Provider: CodeBuild
              Version: 1
            Configuration:
              ProjectName: !Ref CodeBuildProject
            InputArtifacts:
              - Name: SourceOutput
            OutputArtifacts:
              - Name: BuildOutput
      - Name: Package
        Actions:
          - Name: Package
            ActionTypeId:
              Category: Invoke
              Owner: AWS
              Provider: Lambda
              Version: 1
            InputArtifacts:
              - Name: BuildOutput
              - Name: SourceOutput
            Configuration:
              FunctionName: !Ref PackageFunction
              UserParameters: 'develop'

#
# Return the API Gateway endpoints.
#
Outputs:
  ServiceEndpointProd:
    Description: URL of the PROD service endpoint
    Value:
      Fn::Join:
        - ''
        - - 'https://'
          - Ref: ApiGatewayRestApi
          - '.execute-api.'
          - Ref: AWS::Region
          - '.amazonaws.com/prod/api'
  ServiceEndpointDev:
    Description: URL of the DEV service endpoint
    Value:
      Fn::Join:
        - ''
        - - 'https://'
          - Ref: ApiGatewayRestApi
          - '.execute-api.'
          - Ref: AWS::Region
          - '.amazonaws.com/dev/api'
  DeployFunction:
    Description: Deploy Lambda Function
    Value: !Ref DeployFunction
  ShowFunction:
    Description: Show Lambda Function
    Value: !Ref ShowFunction
  APIFunction:
    Description: API Lambda Function
    Value: !Ref APIFunction