AWSTemplateFormatVersion: "2010-09-09"
Description: "Use AWS CodePipeline with third-party git repositories"
Metadata:
  LICENSE: >-
    Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.

    Permission is hereby granted, free of charge, to any person obtaining a copy of this
    software and associated documentation files (the "Software"), to deal in the Software
    without restriction, including without limitation the rights to use, copy, modify,
    merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
    permit persons to whom the Software is furnished to do so.

    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
    INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
    PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
    HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
    OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
    SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Parameters:
  SourceActionVersion:
    Description: The version of the custom source action to use.
    Type: String
    Default: '1'
  SourceActionProvider:
    Description: The provider name of the custom source action.
    Type: String
    Default: 'CustomSourceForGit'
  GitPullLambdaSubnet:
    Description: The subnet that the git pull Lambda function  and CodeBuild will be deployed in. This should be a private subnet with a NAT gateway and your source control should be accessible from this subnet.
    Type: 'List<AWS::EC2::Subnet::Id>'
  GitPullLambdaVpc:
    Description: The VPC you want to deploy the Git Pull lambda function and CodeBuild into.
    Type: 'AWS::EC2::VPC::Id'
    Default: ''
  LambdaCodeS3Bucket:
    Description: S3 bucket name for Lambda code for 3rd party git integration
    Type: String
    Default: aws-codepipeline-third-party-git-repositories-sample
  LambdaCodeS3Key:
    Description: s3 location of the Lambda code for 3rd party git integration
    Type: String
    Default: 'lambda/lambda.zip'

Resources:
  GitPullCodeBuild:
      Type: AWS::CodeBuild::Project
      Properties:
        VpcConfig:
          VpcId: !Ref GitPullLambdaVpc
          SecurityGroupIds: [!Ref GitPullSecurityGroup]
          Subnets: !Ref GitPullLambdaSubnet
        Artifacts:
          Type: NO_ARTIFACTS
        Environment:
          Image: aws/codebuild/standard:2.0
          Type: LINUX_CONTAINER
          ComputeType: BUILD_GENERAL1_SMALL
        QueuedTimeoutInMinutes: 60
        ServiceRole: !GetAtt CodeBuildServiceRole.Arn
        Source:
          BuildSpec: |
              version: 0.2
              env:
                exported-variables:
                  - GIT_COMMIT_ID
                  - GIT_COMMIT_MSG
              phases:
                install:
                    runtime-versions:
                        python: 3.7
                    # commands:
                    # - pip3 install boto3
                build:
                    commands:
                    - echo "=======================Start-Deployment============================="
                    - echo "Setting temporary AWS CLI profile using CodePipeline job poll response"
                    - PROFILE='temp-profile'
                    - aws configure set aws_access_key_id $CodePipelineArtifactAccessKey --profile $PROFILE
                    - aws configure set aws_secret_access_key $CodePipelineArtifactSecretAccessKey --profile $PROFILE
                    - aws configure set aws_session_token $CodePipelineArtifactSessionToken --profile $PROFILE
                    - echo "Getting the SSH Private Key"
                    - aws secretsmanager get-secret-value --secret-id $SSHSecretKeyName --query 'SecretString' --output text >> ~/.ssh/id_rsa
                    # - aws s3api get-object --bucket $KeyBucket --key $KeyObject ~/.ssh/id_rsa
                    - ls ~/
                    - echo "Setting SSH config profile"
                    - |
                      cat > ~/.ssh/config <<EOF
                      Host *
                        AddKeysToAgent yes
                        StrictHostKeyChecking no
                        IdentityFile ~/.ssh/id_rsa
                      EOF
                    - chmod 600 ~/.ssh/id_rsa
                    - echo "Cloning the repository $GitUrl on branch $Branch"
                    - git clone --single-branch --depth=1 --branch $Branch $GitUrl .
                    - ls
                    - echo "Zipping the checked out contents"
                    - zip -r $CodePipelineArtifactBucketObjectKey ./ -x '*.git*'
                    - mv $CodePipelineArtifactBucketObjectKey.zip $CodePipelineArtifactBucketObjectKey
                    - ls -alh
                    - echo "Put the zipped and KMS encrypted Object to Originating Pipelines Artifact Store"
                    - aws s3 cp $CodePipelineArtifactBucketObjectKey s3://$CodePipelineArtifactBucket/$CodePipelineArtifactBucketPath/$CodePipelineArtifactBucketObjectKey --sse aws:kms --sse-kms-key-id $CodePipelineArtifactKMSKeyId --profile $PROFILE
                    - export GIT_COMMIT_ID=$(git rev-parse --short HEAD)
                    - echo $GIT_COMMIT_ID
                    - COMMIT_MSG=$(git log --pretty='format:%Creset%s' --no-merges -1)
                    - export GIT_COMMIT_MSG="${COMMIT_MSG}"
                    - echo $GIT_COMMIT_MSG
                    - echo "=======================End-Deployment============================="
          Type: NO_SOURCE
        TimeoutInMinutes: 14

  CodeBuildServiceRole:
    Type: "AWS::IAM::Role"
    Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Effect: "Allow"
            Principal:
                Service: "codebuild.amazonaws.com"
            Action:
                - "sts:AssumeRole"
        Path: "/"
        ManagedPolicyArns:
          - !Ref CodeBuildEndpointPolicy
        Tags:
          -
              Key: 'tagging-policy'
              Value: !Join ['-', ["test", "ok"]]

  CodeBuildBasePolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
        Description: Policy with base permissions for CodeBuild
        Path: /
        Roles:
          - !Ref CodeBuildServiceRole
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: "Allow"
            Action:
                - "logs:CreateLogGroup"
                - "logs:PutLogEvents"
                - "logs:CreateLogStream"
            Resource:
                - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*"
          - Effect: "Allow"
            Action:
                - 'kms:Encrypt'
                - 'kms:Decrypt'
                - 'kms:ReEncrypt*'
                - 'kms:GenerateDataKey*'
                - 'kms:DescribeKey'
            Resource:
                - !GetAtt KMSKey.Arn
          - Effect: Allow  #For allowing CodeBuild to Access Secrets Manager to retrieve Private SSH key. If a custom KMS key is used, please add the ARN in the Resource section
            Action:
              - 'kms:Encrypt'
              - 'kms:Decrypt'
              - 'kms:ReEncrypt*'
              - 'kms:GenerateDataKey*'
              - 'kms:DescribeKey'
            Resource: !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/aws/secretsmanager"
          - Effect: Allow
            Action:
              - 'secretsmanager:GetSecretValue'
            Resource: !Sub "arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:*"

  CodeBuildEndpointPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
        Description: Policy with permissions for codebuild to work with endpoints
        Path: /
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                  - 'ec2:CreateNetworkInterface'
                  - 'ec2:DescribeDhcpOptions'
                  - 'ec2:DescribeNetworkInterfaces'
                  - 'ec2:DeleteNetworkInterface'
                  - 'ec2:DescribeSubnets'
                  - 'ec2:DescribeSecurityGroups'
                  - 'ec2:DescribeVpcs'
              Resource: '*'
            - Effect: Allow
              Action:
                  - 'ec2:CreateNetworkInterfacePermission'
              Resource: !Sub 'arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:network-interface/*'
              Condition:
                StringEquals: {"ec2:Subnet": [{
                      "Fn::Join": ["", ["arn:aws:ec2:", {"Ref" : "AWS::Region" },":", {"Ref" : "AWS::AccountId"}, ":subnet/", { "Fn::Select" : [ "0", {"Ref": "GitPullLambdaSubnet"} ] }
                        ]
                      ]
                    },
                    {
                      "Fn::Join": ["", ["arn:aws:ec2:", {"Ref" : "AWS::Region" },":", {"Ref" : "AWS::AccountId"}, ":subnet/", { "Fn::Select" : [ "1", {"Ref": "GitPullLambdaSubnet"} ] }
                        ]
                      ]
                    }],
                  "ec2:AuthorizedService": "codebuild.amazonaws.com"}

  CustomSourceAction:
    Type: 'AWS::CodePipeline::CustomActionType'
    Properties:
        Category: 'Source'
        Settings:
            EntityUrlTemplate: 'https://docs.aws.amazon.com/codepipeline/latest/userguide/actions-create-custom-action.html'
            ExecutionUrlTemplate: 'https://docs.aws.amazon.com/codepipeline/latest/userguide/actions-create-custom-action.html'
        ConfigurationProperties:
            - Name: Branch
              Required: true
              Key: false
              Secret: false
              Queryable: false
              Description: 'Git branch to pull.'
              Type: String
            - Name: GitUrl
              Required: true
              Key: false
              Secret: false
              Queryable: false
              Description: 'SSH git clone URL.'
              Type: String
            - Name: PipelineName
              Required: true
              Key: false
              Secret: false
              Queryable: true
              Description: 'Name of the CodePipeline'
              Type: String
            - Name: SSHSecretKeyName
              Required: true
              Key: false
              Secret: false
              Queryable: false
              Description: 'Name of the Secret for SSH private Key'
              Type: String
        InputArtifactDetails:
            MaximumCount: 0
            MinimumCount: 0
        OutputArtifactDetails:
            MaximumCount: 1
            MinimumCount: 1
        Provider: !Ref SourceActionProvider
        Version: !Ref SourceActionVersion

  CodePipelineCustomActionFunction:
    Type: AWS::Lambda::Function
    Properties:
        Handler: lambda_function.lambda_handler
        VpcConfig:
          SecurityGroupIds: [!Ref GitPullSecurityGroup]
          SubnetIds: !Ref GitPullLambdaSubnet
        Environment:
            Variables:
                GitPullCodeBuild: !Ref GitPullCodeBuild
        Role: !GetAtt 'LambdaExecutionRole.Arn'
        Runtime: python3.7
        Timeout: 900
        Code:
          S3Bucket: !Ref LambdaCodeS3Bucket
          S3Key: !Ref LambdaCodeS3Key

  LambdaExecutionRole:
      Type: AWS::IAM::Role
      Properties:
          ManagedPolicyArns:
            - !Ref CodeBuildEndpointPolicy
          AssumeRolePolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Principal:
                      Service:
                        - lambda.amazonaws.com
                  Action:
                    - sts:AssumeRole
          Path: /
          Policies:
            - PolicyName: root
              PolicyDocument:
                  Version: '2012-10-17'
                  Statement:
                    - Effect: Allow
                      Action:
                        - logs:CreateLogGroup
                        - "logs:CreateLogStream"
                        - "logs:PutLogEvents"
                      Resource:
                        - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
                    - Effect: Allow
                      Action:
                        - codepipeline:PollForJobs
                        - codepipeline:AcknowledgeJob
                        - codepipeline:GetJobDetails
                        - codepipeline:PutJobSuccessResult
                        - codepipeline:PutJobFailureResult
                        - codepipeline:StopPipelineExecution
                      Resource: '*'
                    - Effect: Allow
                      Action:
                        - codebuild:StartBuild
                        - codebuild:BatchGetBuilds
                      Resource:
                        - !GetAtt GitPullCodeBuild.Arn

  CodePipelineCustomActionFunctionPermissions:
      Type: AWS::Lambda::Permission
      Properties:
          Action: 'lambda:InvokeFunction'
          FunctionName: !GetAtt CodePipelineCustomActionFunction.Arn
          Principal: 'events.amazonaws.com'

  CodePipelineCustomActionTrigger:
      Type: "AWS::Events::Rule"
      Properties:
          State: "ENABLED"
          Description: !Sub "Handles the ${SourceActionProvider} custom provider for CodePipeline."
          EventPattern: !Sub |
              {
                  "source": ["aws.codepipeline"],
                  "detail-type": ["CodePipeline Action Execution State Change"],
                  "detail": {
                      "type": {
                          "provider": ["${SourceActionProvider}"],
                          "category": ["Source"],
                          "owner": ["Custom"]
                      },
                      "state": ["STARTED"]
                  }
              }
          Targets:
            - Arn: !GetAtt CodePipelineCustomActionFunction.Arn
              Id: "CodePipelineCustomActionTrigger"

  GitPullSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: 'Security group for the lambda function performing git pulls.'
      SecurityGroupEgress:
        - CidrIp: '0.0.0.0/0'
          IpProtocol: 'tcp'
          FromPort: '0'
          ToPort: '65535'
      VpcId: !Ref GitPullLambdaVpc

  KMSKey:
    Type: 'AWS::KMS::Key'
    Properties:
      Description: 'git CodePipeline integration, bucket to store ssh keys'
      KeyPolicy:
        Version: 2012-10-17
        Statement:
          - Sid: Allow access for Key Administrators
            Effect: Allow
            Principal:
              AWS:
                - !Join
                  - ''
                  - - 'arn:aws:iam::'
                    - !Ref 'AWS::AccountId'
                    - ':root'
            Action:
              - 'kms:Create*'
              - 'kms:Describe*'
              - 'kms:Enable*'
              - 'kms:List*'
              - 'kms:Put*'
              - 'kms:Update*'
              - 'kms:Revoke*'
              - 'kms:Disable*'
              - 'kms:Get*'
              - 'kms:Delete*'
              - 'kms:ScheduleKeyDeletion'
              - 'kms:CancelKeyDeletion'
            Resource: '*'
          - Sid: Allow use of the key
            Effect: Allow
            Principal:
              AWS:
                - !Sub "${CodeBuildServiceRole.Arn}"
            Action:
              - 'kms:Encrypt'
              - 'kms:Decrypt'
              - 'kms:ReEncrypt*'
              - 'kms:GenerateDataKey*'
              - 'kms:DescribeKey'
            Resource: '*'