Skip to content

Commit e6ed4bf

Browse files
RitvikKapilaRitvikKapila
authored
chore(CFN): Adding cfn template (#780)
1 parent 921aeda commit e6ed4bf

File tree

1 file changed

+364
-0
lines changed

1 file changed

+364
-0
lines changed

‎cfn/CB.yml

+364
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,364 @@
1+
AWSTemplateFormatVersion: "2010-09-09"
2+
Description: "Template to build a CodeBuild Project, assumes that GitHub credentials are already set up."
3+
Parameters:
4+
ProjectName:
5+
Type: String
6+
Description: The name of the CodeBuild Project
7+
ProjectDescription:
8+
Type: String
9+
Description: The description for the CodeBuild Project
10+
SourceLocation:
11+
Type: String
12+
Description: The https GitHub URL for the project
13+
NumberOfBuildsInBatch:
14+
Type: Number
15+
MaxValue: 100
16+
MinValue: 1
17+
Default: 4
18+
Description: The number of builds you expect to run in a batch
19+
20+
Metadata:
21+
AWS::CloudFormation::Interface:
22+
ParameterGroups:
23+
-
24+
Label:
25+
default: "Crypto Tools CodeBuild Project Template"
26+
Parameters:
27+
- ProjectName
28+
- ProjectDescription
29+
- SourceLocation
30+
31+
Resources:
32+
CodeBuildProject:
33+
Type: "AWS::CodeBuild::Project"
34+
Properties:
35+
Name: !Ref ProjectName
36+
Description: !Ref ProjectDescription
37+
Source:
38+
Location: !Ref SourceLocation
39+
GitCloneDepth: 1
40+
GitSubmodulesConfig:
41+
FetchSubmodules: false
42+
InsecureSsl: false
43+
ReportBuildStatus: false
44+
Type: "GITHUB"
45+
Triggers:
46+
BuildType: BUILD_BATCH
47+
Webhook: True
48+
FilterGroups:
49+
- - Type: EVENT
50+
Pattern: PULL_REQUEST_CREATED,PULL_REQUEST_UPDATED,PUSH,PULL_REQUEST_REOPENED
51+
Artifacts:
52+
Type: "NO_ARTIFACTS"
53+
Cache:
54+
Type: "NO_CACHE"
55+
Environment:
56+
ComputeType: "BUILD_GENERAL1_SMALL"
57+
Image: "aws/codebuild/standard:3.0"
58+
ImagePullCredentialsType: "CODEBUILD"
59+
PrivilegedMode: false
60+
Type: "LINUX_CONTAINER"
61+
ServiceRole: !GetAtt CodeBuildCIServiceRole.Arn
62+
TimeoutInMinutes: 60
63+
QueuedTimeoutInMinutes: 480
64+
EncryptionKey: !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/aws/s3"
65+
BadgeEnabled: false
66+
BuildBatchConfig:
67+
ServiceRole: !GetAtt CodeBuildCIServiceRole.Arn
68+
Restrictions:
69+
MaximumBuildsAllowed: !Ref NumberOfBuildsInBatch
70+
ComputeTypesAllowed:
71+
- BUILD_GENERAL1_SMALL
72+
- BUILD_GENERAL1_MEDIUM
73+
TimeoutInMins: 480
74+
LogsConfig:
75+
CloudWatchLogs:
76+
Status: "ENABLED"
77+
S3Logs:
78+
Status: "DISABLED"
79+
EncryptionDisabled: false
80+
81+
CodeBuildProjectTestRelease:
82+
Type: "AWS::CodeBuild::Project"
83+
Properties:
84+
Name: !Sub "${ProjectName}-test-release"
85+
Description: !Sub "CodeBuild project for ${ProjectName} to release to test PyPi."
86+
Source:
87+
Location: !Ref SourceLocation
88+
BuildSpec: "codebuild/release/test-release.yml"
89+
GitCloneDepth: 1
90+
GitSubmodulesConfig:
91+
FetchSubmodules: false
92+
InsecureSsl: false
93+
ReportBuildStatus: false
94+
Type: "GITHUB"
95+
Artifacts:
96+
Type: "NO_ARTIFACTS"
97+
Cache:
98+
Type: "NO_CACHE"
99+
Environment:
100+
ComputeType: "BUILD_GENERAL1_SMALL"
101+
Image: "aws/codebuild/standard:3.0"
102+
ImagePullCredentialsType: "CODEBUILD"
103+
PrivilegedMode: false
104+
Type: "LINUX_CONTAINER"
105+
ServiceRole: !GetAtt CodeBuildServiceRole.Arn
106+
TimeoutInMinutes: 60
107+
QueuedTimeoutInMinutes: 480
108+
EncryptionKey: !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/aws/s3"
109+
BadgeEnabled: false
110+
BuildBatchConfig:
111+
ServiceRole: !GetAtt CodeBuildServiceRole.Arn
112+
Restrictions:
113+
MaximumBuildsAllowed: !Ref NumberOfBuildsInBatch
114+
ComputeTypesAllowed:
115+
- BUILD_GENERAL1_SMALL
116+
- BUILD_GENERAL1_MEDIUM
117+
TimeoutInMins: 480
118+
LogsConfig:
119+
CloudWatchLogs:
120+
Status: "ENABLED"
121+
S3Logs:
122+
Status: "DISABLED"
123+
EncryptionDisabled: false
124+
125+
CodeBuildProjectProdRelease:
126+
Type: "AWS::CodeBuild::Project"
127+
Properties:
128+
Name: !Sub "${ProjectName}-prod-release"
129+
Description: !Sub "CodeBuild project for ${ProjectName} to release to prod PyPi."
130+
Source:
131+
Location: !Ref SourceLocation
132+
BuildSpec: "codebuild/release/prod-release.yml"
133+
GitCloneDepth: 1
134+
GitSubmodulesConfig:
135+
FetchSubmodules: false
136+
InsecureSsl: false
137+
ReportBuildStatus: false
138+
Type: "GITHUB"
139+
Artifacts:
140+
Type: "NO_ARTIFACTS"
141+
Cache:
142+
Type: "NO_CACHE"
143+
Environment:
144+
ComputeType: "BUILD_GENERAL1_SMALL"
145+
Image: "aws/codebuild/standard:3.0"
146+
ImagePullCredentialsType: "CODEBUILD"
147+
PrivilegedMode: false
148+
Type: "LINUX_CONTAINER"
149+
ServiceRole: !GetAtt CodeBuildServiceRole.Arn
150+
TimeoutInMinutes: 60
151+
QueuedTimeoutInMinutes: 480
152+
EncryptionKey: !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/aws/s3"
153+
BadgeEnabled: false
154+
BuildBatchConfig:
155+
ServiceRole: !GetAtt CodeBuildServiceRole.Arn
156+
Restrictions:
157+
MaximumBuildsAllowed: !Ref NumberOfBuildsInBatch
158+
ComputeTypesAllowed:
159+
- BUILD_GENERAL1_SMALL
160+
- BUILD_GENERAL1_MEDIUM
161+
TimeoutInMins: 480
162+
LogsConfig:
163+
CloudWatchLogs:
164+
Status: "ENABLED"
165+
S3Logs:
166+
Status: "DISABLED"
167+
EncryptionDisabled: false
168+
169+
CodeBuildServiceRole:
170+
Type: "AWS::IAM::Role"
171+
Properties:
172+
Path: "/service-role/"
173+
RoleName: !Sub "codebuild-${ProjectName}-service-role"
174+
AssumeRolePolicyDocument: "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"codebuild.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}"
175+
MaxSessionDuration: 3600
176+
ManagedPolicyArns:
177+
- !Ref CryptoToolsKMS
178+
- !Ref CodeBuildBatchPolicy
179+
- !Ref CodeBuildBasePolicy
180+
- !Ref SecretsManagerPolicy
181+
- !Ref DDBPolicy
182+
- "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess"
183+
184+
CodeBuildCIServiceRole:
185+
Type: "AWS::IAM::Role"
186+
Properties:
187+
Path: "/service-role/"
188+
RoleName: !Sub "codebuild-${ProjectName}-CI-service-role"
189+
AssumeRolePolicyDocument: "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"codebuild.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}"
190+
MaxSessionDuration: 3600
191+
ManagedPolicyArns:
192+
- !Ref CryptoToolsKMS
193+
- !Ref CodeBuildCIBatchPolicy
194+
- !Ref CodeBuildBasePolicy
195+
- !Ref DDBPolicy
196+
- "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess"
197+
198+
CodeBuildBatchPolicy:
199+
Type: "AWS::IAM::ManagedPolicy"
200+
Properties:
201+
ManagedPolicyName: !Sub "CodeBuildBuildBatchPolicy-${ProjectName}-${AWS::Region}-codebuild-${ProjectName}-service-role"
202+
Path: "/service-role/"
203+
PolicyDocument: !Sub |
204+
{
205+
"Version": "2012-10-17",
206+
"Statement": [
207+
{
208+
"Effect": "Allow",
209+
"Resource": [
210+
"arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${ProjectName}",
211+
"arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${ProjectName}-test-release",
212+
"arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${ProjectName}-prod-release"
213+
],
214+
"Action": [
215+
"codebuild:StartBuild",
216+
"codebuild:StopBuild",
217+
"codebuild:RetryBuild"
218+
]
219+
}
220+
]
221+
}
222+
223+
CodeBuildCIBatchPolicy:
224+
Type: "AWS::IAM::ManagedPolicy"
225+
Properties:
226+
ManagedPolicyName: !Sub "CodeBuildBuildBatchPolicy-${ProjectName}-${AWS::Region}-codebuild-${ProjectName}-CI-service-role"
227+
Path: "/service-role/"
228+
PolicyDocument: !Sub |
229+
{
230+
"Version": "2012-10-17",
231+
"Statement": [
232+
{
233+
"Effect": "Allow",
234+
"Resource": [
235+
"arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${ProjectName}"
236+
],
237+
"Action": [
238+
"codebuild:StartBuild",
239+
"codebuild:StopBuild",
240+
"codebuild:RetryBuild"
241+
]
242+
}
243+
]
244+
}
245+
246+
CodeBuildBasePolicy:
247+
Type: "AWS::IAM::ManagedPolicy"
248+
Properties:
249+
ManagedPolicyName: !Sub "CodeBuildBasePolicy-${ProjectName}-${AWS::Region}"
250+
Path: "/service-role/"
251+
PolicyDocument: !Sub |
252+
{
253+
"Version": "2012-10-17",
254+
"Statement": [
255+
{
256+
"Effect": "Allow",
257+
"Resource": [
258+
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}",
259+
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}:*",
260+
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}-test-release",
261+
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}-test-release:*",
262+
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}-prod-release",
263+
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}-prod-release:*"
264+
],
265+
"Action": [
266+
"logs:CreateLogGroup",
267+
"logs:CreateLogStream",
268+
"logs:PutLogEvents"
269+
]
270+
},
271+
{
272+
"Effect": "Allow",
273+
"Resource": [
274+
"arn:aws:s3:::codepipeline-${AWS::Region}-*"
275+
],
276+
"Action": [
277+
"s3:PutObject",
278+
"s3:GetObject",
279+
"s3:GetObjectVersion",
280+
"s3:GetBucketAcl",
281+
"s3:GetBucketLocation"
282+
]
283+
},
284+
{
285+
"Effect": "Allow",
286+
"Action": [
287+
"codebuild:CreateReportGroup",
288+
"codebuild:CreateReport",
289+
"codebuild:UpdateReport",
290+
"codebuild:BatchPutTestCases",
291+
"codebuild:BatchPutCodeCoverages"
292+
],
293+
"Resource": [
294+
"arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:report-group/${ProjectName}-*"
295+
]
296+
}
297+
]
298+
}
299+
300+
SecretsManagerPolicy:
301+
Type: "AWS::IAM::ManagedPolicy"
302+
Properties:
303+
ManagedPolicyName: !Sub "CryptoTools-SecretsManager-${ProjectName}-release"
304+
Path: "/service-role/"
305+
PolicyDocument: !Sub |
306+
{
307+
"Version": "2012-10-17",
308+
"Statement": [
309+
{
310+
"Effect": "Allow",
311+
"Resource": [
312+
"arn:aws:secretsmanager:us-west-2:587316601012:secret:TestPyPiAPIToken-uERFjs",
313+
"arn:aws:secretsmanager:us-west-2:587316601012:secret:PyPiAPIToken-nu1Gu6"
314+
],
315+
"Action": "secretsmanager:GetSecretValue"
316+
}
317+
]
318+
}
319+
320+
DDBPolicy:
321+
Type: "AWS::IAM::ManagedPolicy"
322+
Properties:
323+
ManagedPolicyName: !Sub "CryptoTools-DynamoDB-${ProjectName}-CI"
324+
Path: "/service-role/"
325+
PolicyDocument: !Sub |
326+
{
327+
"Version": "2012-10-17",
328+
"Statement": [
329+
{
330+
"Effect": "Allow",
331+
"Resource": [
332+
"arn:aws:dynamodb:us-east-1:587316601012:table/ddbec-mrk-testing",
333+
"arn:aws:dynamodb:us-west-2:587316601012:table/ddbec-mrk-testing"
334+
],
335+
"Action": "*"
336+
}
337+
]
338+
}
339+
340+
# There exist public AWS KMS CMKs that are used for testing
341+
# Take care with these CMKs they are **ONLY** for testing!!!
342+
CryptoToolsKMS:
343+
Type: "AWS::IAM::ManagedPolicy"
344+
Properties:
345+
ManagedPolicyName: !Sub "CrypotToolsKMSPolicy-${ProjectName}-${AWS::Region}-codebuild-${ProjectName}-service-role"
346+
Path: "/service-role/"
347+
PolicyDocument: !Sub |
348+
{
349+
"Version": "2012-10-17",
350+
"Statement": [
351+
{
352+
"Effect": "Allow",
353+
"Resource": [
354+
"arn:aws:kms:*:658956600833:key/*",
355+
"arn:aws:kms:*:658956600833:alias/*"
356+
],
357+
"Action": [
358+
"kms:Encrypt",
359+
"kms:Decrypt",
360+
"kms:GenerateDataKey"
361+
]
362+
}
363+
]
364+
}

0 commit comments

Comments
 (0)