sample_web_application.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'AWS CloudFormation Template: Web application using EC2, S3, Lambda, DynamoDB, CodeBuild, and SecretsManager with IAM roles.'

Resources:
  WebServerInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0abcdef1234567890  # Specify your AMI ID
      InstanceType: t2.micro
      KeyName: MyKeyName  # Specify your key pair
      SecurityGroups:
        - Ref: InstanceSecurityGroup
      IamInstanceProfile:
        Ref: EC2InstanceProfile

  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable HTTP access
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0

  EC2InstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: AccessS3DynamoDB
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 's3:GetObject'
                  - 's3:PutObject'
                Resource: !Sub 'arn:aws:s3:::${ApplicationBucket}/*'
              - Effect: Allow
                Action:
                  - 'dynamodb:*'
                Resource: !GetAtt ApplicationTable.Arn

  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - Ref: EC2InstanceRole

  ApplicationBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-application-bucket

  ApplicationLambda:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: |
          import json
          def handler(event, context):
            return {
              'statusCode': 200,
              'body': json.dumps('Hello from Lambda')
            }
      Handler: index.handler
      Runtime: python3.8
      Role: !GetAtt LambdaExecutionRole.Arn

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: LambdaDynamoDBAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 'dynamodb:GetItem'
                  - 'dynamodb:PutItem'
                Resource: !GetAtt ApplicationTable.Arn
              - Effect: Allow
                Action: 'logs:*'
                Resource: 'arn:aws:logs:*:*:*'

  ApplicationTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: ApplicationData
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      BillingMode: PAY_PER_REQUEST

  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: WebAppBuildProject
      Source:
        Type: GITHUB
        Location: https://github.com/user/repo.git
      Environment:
        Type: LINUX_CONTAINER
        Image: aws/codebuild/standard:4.0
        ComputeType: BUILD_GENERAL1_SMALL
      Artifacts:
        Type: NO_ARTIFACTS
      ServiceRole: !Ref CodeBuildRole

  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: CodeBuildS3SecretsAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - 's3:GetObject'
                  - 's3:PutObject'
                Resource: !Sub 'arn:aws:s3:::${ApplicationBucket}/*'
              - Effect: Allow
                Action:
                  - 'secretsmanager:GetSecretValue'
                Resource: !Ref AppSecret

  AppSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: AppSecret
      Description: Stores sensitive application credentials
      SecretString: '{"username":"admin","password":"password"}'

Outputs:
  WebServerIP:
    Description: "Public IP of the web server"
    Value: !GetAtt WebServerInstance.PublicIp
  BucketName:
    Description: "S3 Bucket for application storage"
    Value: !Ref ApplicationBucket
  LambdaFunctionName:
    Description: "Lambda function name"
    Value: !Ref ApplicationLambda
  DynamoDBTableName:
    Description: "DynamoDB table name"
    Value: !Ref ApplicationTable
  CodeBuildProjectName:
    Description: "CodeBuild project name"
    Value: !Ref CodeBuildProject
  SecretId:
    Description: "Secret ID for the application"
    Value: !Ref AppSecret