hyp3/cicd-stacks/ASF-deployment-ci-cf.yml at develop · ASFHyP3/hyp3 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
AWSTemplateFormatVersion: 2010-09-09

Parameters:
  TemplateBucketName:
    Description: AWS S3 bucket name for uploading CloudFormation templates
    Type: String

Resources:
  CloudformationDeploymentRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          Action: sts:AssumeRole
          Principal:
            Service: cloudformation.amazonaws.com
          Effect: Allow
      Policies:
        - PolicyName: cloud-formation-deployment-policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - ec2:*
                  - s3:*
                  - ecs:*
                  - batch:*
                  - events:*
                  - logs:*
                  - iam:*
                  - lambda:*
                  - ssm:GetParameters
                  - apigateway:*
                  - states:*
                  - dynamodb:*
                  - rds:*
                  - cloudwatch:*
                  - sns:*
                  - secretsmanager:*
                  - kms:*
                Resource: "*"

              - Effect: Allow
                Action:
                  - cloudformation:SetStackPolicy
                  - cloudformation:CreateStack
                  - cloudformation:UpdateStack
                  - cloudformation:DeleteStack
                  - cloudformation:CreateChangeSet
                  - cloudformation:DescribeChangeSet
                  - cloudformation:ExecuteChangeSet
                  - cloudformation:DeleteChangeSet
                  - cloudformation:GetTemplateSummary
                Resource: !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/*"

  GithubActionsUser:
    Type: AWS::IAM::User
    Properties:
      UserName: github-actions
      Policies:
        - PolicyName: github-actions-user-policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - cloudformation:ValidateTemplate
                  - cloudformation:DescribeStacks
                  - ssm:GetParameters
                Resource: "*"

              - Effect: Allow
                Action: iam:PassRole
                Resource: !GetAtt CloudformationDeploymentRole.Arn
                Condition:
                  StringLike:
                    iam:AssociatedResourceArn: !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/*"

              - Effect: Allow
                Action: s3:PutObject
                Resource: !Sub "arn:aws:s3:::${TemplateBucketName}/*"

              - Effect: Allow
                Action:
                  - cloudformation:SetStackPolicy
                  - cloudformation:CreateStack
                  - cloudformation:UpdateStack
                  - cloudformation:CreateChangeSet
                  - cloudformation:DescribeChangeSet
                  - cloudformation:ExecuteChangeSet
                  - cloudformation:DeleteChangeSet
                  - cloudformation:GetTemplateSummary
                Resource: !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/*"

  ApiGatewayLoggingRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          Action: sts:AssumeRole
          Principal:
            Service: apigateway.amazonaws.com
          Effect: Allow
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs

  ApiGatewayLoggingPermission:
    Type: AWS::ApiGateway::Account
    Properties:
      CloudWatchRoleArn: !GetAtt ApiGatewayLoggingRole.Arn