pipeline-roles.yaml

---
AWSTemplateFormatVersion: 2010-09-09

Description: >
  This template deploys the roles that will be needed for the pipeline

Parameters:

  AppName:
    Type: String
    Description: Name of the application.
    MinLength: "1"
    MaxLength: "80"
    AllowedPattern: "[A-Za-z0-9-]+"
    ConstraintDescription: Malformed input parameter. AppName must only contain upper and lower case letters, numbers, and -.

  AppStackName:
    Type: String
    Description: Name of stack for the application.
    MinLength: "1"
    MaxLength: "80"
    AllowedPattern: "[A-Za-z0-9-]+"
    ConstraintDescription: Malformed input parameter. AppStackName must only contain upper and lower case letters, numbers, and -.

Resources:

  codeBuildTrustRole:
    Description: Creating service role in IAM for AWS CodeBuild
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AppName}-codebuild-role
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: codebuild.amazonaws.com
          Action: sts:AssumeRole
      Path: /

  codeBuildRolePolicy:
    Description: Setting IAM policy for the service role for AWS CodeBuild
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub ${AppName}-CodeBuildRolePolicy-${AWS::Region}
      PolicyDocument:
        Statement:
        - Effect: Allow
          Action:
          - logs:CreateLogGroup
          - logs:CreateLogStream
          - logs:PutLogEvents
          Resource:
          - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*
        - Effect: Allow
          Action:
          - cloudformation:DescribeStacks
          Resource:
          - !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AppName}-*
        - Effect: Allow
          Action:
          - dynamodb:PutItem
          Resource: !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${AppName}-*"
      Roles:
      - !Ref codeBuildTrustRole

  codePipelineTrustRole:
    Description: Creating service role in IAM for AWS CodePipeline
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AppName}-codepipeline-role
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: codepipeline.amazonaws.com
          Action: sts:AssumeRole
      Path: /

  codePipelineRolePolicy:
    Description: Setting IAM policy for the service role for AWS CodePipeline
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub ${AppName}-CodePipelineRolePolicy-${AWS::Region}
      PolicyDocument:
        Statement:
        - Effect: Allow
          Action:
          - codebuild:StartBuild
          - codebuild:BatchGetBuilds
          Resource: "*"
        - Effect: Allow
          Action:
          - iam:GetRole
          - iam:PassRole
          Resource: !GetAtt lambdaDeployTrustRole.Arn
        - Effect: Allow
          Action:
          - cloudformation:Describe*
          - cloudformation:CreateChangeSet
          - cloudformation:DeleteChangeSet
          - cloudformation:ExecuteChangeSet
          Resource: !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AppStackName}/*"
      Roles:
      - !Ref codePipelineTrustRole

  lambdaDeployTrustRole:
    Description: Creating service role in IAM for AWS CodePipeline
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AppName}-LambdaDeploy-role
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: cloudformation.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess
      Path: /

  lambdaDeployRolePolicy:
    Description: Setting IAM policy for for AWS CodePipeline to deploy Lambdas
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub ${AppName}-LambdaDeployRolePolicy-${AWS::Region}
      PolicyDocument:
        Statement:
        - Effect: Allow
          Action:
          - cloudformation:Create*
          - cloudformation:ExecuteChangeSet
          - cloudformation:SetStackPolicy
          - cloudformation:SignalResource
          - cloudformation:StopStackSetOperation
          - cloudformation:Update*
          Resource: "*"
        - Effect: Allow
          Action:
          - apigateway:*
          Resource: !Sub "arn:aws:apigateway:${AWS::Region}::*"
        - Effect: Allow
          Action:
          - iam:GetRole
          - iam:CreateRole
          - iam:DeleteRole
          Resource: !Sub "arn:aws:iam::${AWS::AccountId}:role/${AppName}-*"
        - Effect: Allow
          Action:
          - iam:AttachRolePolicy
          - iam:DetachRolePolicy
          - iam:PutRolePolicy
          Resource: !Sub "arn:aws:iam::${AWS::AccountId}:role/${AppName}-*"
        - Effect: Allow
          Action:
          - iam:PassRole
          Resource: "*"
        - Effect: Allow
          Action:
          - lambda:*
          Resource: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${AppName}-*"
        - Effect: Allow
          Action:
          - dynamodb:*
          Resource: !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${AppName}-*"
      Roles:
      - !Ref lambdaDeployTrustRole

Outputs:

  CodeBuildRoleArn:
    Description: Role ARN for code build to build
    Value: !GetAtt codeBuildTrustRole.Arn

  CodeBuildRoleName:
    Description: Role name for code build to build
    Value: !Ref codeBuildTrustRole

  CodePipelineRoleArn:
    Description: Role ARN for code pipeline
    Value: !GetAtt codePipelineTrustRole.Arn

  CodePipelineRoleName:
    Description: Role name for code pipeline
    Value: !Ref codePipelineTrustRole

  LambdaDeployRoleArn:
    Description: Role ARN for deploying lambdas
    Value: !GetAtt lambdaDeployTrustRole.Arn

  LambdaDeployRoleName:
    Description: Role name for deploying lambdas
    Value: !Ref lambdaDeployTrustRole