Skip to content

chore: updating prod template to remove resources and abstract ones #354

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Oct 4, 2021
Merged

chore: updating prod template to remove resources and abstract ones #354

Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
524842a
chore: removing extra log p[olicy that is not needed for prod-release
josecorella Sep 28, 2021
746ee3e
chore: adding aws account id subsitution
josecorella Sep 28, 2021
83fb8fd
chore: adding accountid back to managepolicy
josecorella Sep 29, 2021
fc2ae56
chore: correctly formatting secrets policy
josecorella Sep 29, 2021
87be1ad
chore: rename file and adding cfn template for our CI project
josecorella Sep 30, 2021
35b1b7d
chore: format json
josecorella Sep 30, 2021
b49aad9
style: add new line between resources
josecorella Oct 4, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
131 changes: 107 additions & 24 deletions cfn/prod-release.yml → cfn/ci_cd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,11 @@ Parameters:
ProjectName:
Type: String
Description: The name of the CodeBuild Project
Default: java-esdk-prod
Default: AWS-ESDK-Java
ProjectDescription:
Type: String
Description: The description for the CodeBuild Project
Default: CFN stack for managing CodeBuild Release project for the ESDK-Java
Default: CFN stack for managing CodeBuild projects for the AWS ESDK Java
SourceLocation:
Type: String
Description: The https GitHub URL for the project
Expand All @@ -22,7 +22,7 @@ Parameters:
Type: Number
MaxValue: 100
MinValue: 1
Default: 10
Default: 16
Description: The number of builds you expect to run in a batch
Metadata:
"AWS::CloudFormation::Interface":
Expand All @@ -34,14 +34,64 @@ Metadata:
- ProjectDescription
- SourceLocation
Resources:
CodeBuildProjectCI:
Type: "AWS::CodeBuild::Project"
Properties:
Name: !Sub "${ProjectName}-CI"
Description: !Sub "CI for the Java ESDK"
Source:
Location: !Ref SourceLocation
BuildSpec: codebuild/ci/ci.yml
GitCloneDepth: 1
GitSubmodulesConfig:
FetchSubmodules: false
InsecureSsl: false
ReportBuildStatus: false
Type: GITHUB
Triggers:
BuildType: BUILD_BATCH
Webhook: true
FilterGroups:
- - Type: EVENT
Pattern: PULL_REQUEST_CREATED, PULL_REQUEST_UPDATED, PULL_REQUEST_REOPENED
Artifacts:
Type: NO_ARTIFACTS
Cache:
Type: NO_CACHE
Environment:
ComputeType: BUILD_GENERAL1_LARGE
Image: "aws/codebuild/standard:5.0"
ImagePullCredentialsType: CODEBUILD
PrivilegedMode: false
Type: LINUX_CONTAINER
ServiceRole: !GetAtt CodeBuildServiceRoleCI.Arn
TimeoutInMinutes: 60
QueuedTimeoutInMinutes: 480
EncryptionKey: !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/aws/s3"
BadgeEnabled: false
BuildBatchConfig:
ServiceRole: !GetAtt CodeBuildServiceRoleCI.Arn
Restrictions:
MaximumBuildsAllowed: !Ref NumberOfBuildsInBatch
ComputeTypesAllowed:
- BUILD_GENERAL1_SMALL
- BUILD_GENERAL1_MEDIUM
- BUILD_GENERAL1_LARGE
TimeoutInMins: 480
LogsConfig:
CloudWatchLogs:
Status: ENABLED
S3Logs:
Status: DISABLED
EncryptionDisabled: false
CodeBuildProjectRelease:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
EncryptionDisabled: false
CodeBuildProjectRelease:
EncryptionDisabled: false
CodeBuildProjectRelease:

nit: new line b/w resources

Type: "AWS::CodeBuild::Project"
Properties:
Name: !Sub "${ProjectName}-release-prod"
Name: !Sub "${ProjectName}-Release"
Description: !Sub "CodeBuild project for ${ProjectName} to release to Sonatype."
Source:
Location: !Ref SourceLocation
BuildSpec: codebuild/release/prod-release.yml
BuildSpec: codebuild/release/release.yml
GitCloneDepth: 1
GitSubmodulesConfig:
FetchSubmodules: false
Expand All @@ -54,17 +104,17 @@ Resources:
Type: NO_CACHE
Environment:
ComputeType: BUILD_GENERAL1_LARGE
Image: "aws/codebuild/standard:4.0"
Image: "aws/codebuild/standard:5.0"
ImagePullCredentialsType: CODEBUILD
PrivilegedMode: false
Type: LINUX_CONTAINER
ServiceRole: !GetAtt CodeBuildServiceRole.Arn
ServiceRole: !GetAtt CodeBuildServiceRoleRelease.Arn
TimeoutInMinutes: 60
QueuedTimeoutInMinutes: 480
EncryptionKey: !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/aws/s3"
BadgeEnabled: false
BuildBatchConfig:
ServiceRole: !GetAtt CodeBuildServiceRole.Arn
ServiceRole: !GetAtt CodeBuildServiceRoleRelease.Arn
Restrictions:
MaximumBuildsAllowed: !Ref NumberOfBuildsInBatch
ComputeTypesAllowed:
Expand All @@ -78,19 +128,35 @@ Resources:
S3Logs:
Status: DISABLED
EncryptionDisabled: false
CodeBuildServiceRole:
CodeBuildServiceRoleCI:
Type: "AWS::IAM::Role"
Properties:
Path: /service-role/
RoleName: !Sub "codebuild-${ProjectName}-service-role-ci"
AssumeRolePolicyDocument: >-
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"codebuild.amazonaws.com"},"Action":"sts:AssumeRole"}]}
MaxSessionDuration: 3600
ManagedPolicyArns:
- !Ref CryptoToolsKMS
- !Ref CodeBuildBatchPolicy
- !Ref CodeBuildBasePolicy
- !Ref SecretsManagerPolicyCI
- !Ref ParameterStorePolicy
- "arn:aws:iam::aws:policy/AWSCodeArtifactReadOnlyAccess"
- "arn:aws:iam::aws:policy/AWSCodeArtifactAdminAccess"
CodeBuildServiceRoleRelease:
Type: "AWS::IAM::Role"
Properties:
Path: /service-role/
RoleName: !Sub "codebuild-${ProjectName}-service-role"
RoleName: !Sub "codebuild-${ProjectName}-service-role-release"
AssumeRolePolicyDocument: >-
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"codebuild.amazonaws.com"},"Action":"sts:AssumeRole"}]}
MaxSessionDuration: 3600
ManagedPolicyArns:
- !Ref CryptoToolsKMS
- !Ref CodeBuildBatchPolicy
- !Ref CodeBuildBasePolicy
- !Ref SecretsManagerPolicy
- !Ref SecretsManagerPolicyRelease
- !Ref ParameterStorePolicy
- "arn:aws:iam::aws:policy/AWSCodeArtifactReadOnlyAccess"
- "arn:aws:iam::aws:policy/AWSCodeArtifactAdminAccess"
Expand All @@ -107,8 +173,8 @@ Resources:
{
"Effect": "Allow",
"Resource": [
"arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${ProjectName}-test-release",
"arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${ProjectName}-prod-release",
"arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${ProjectName}-Release",
"arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${ProjectName}-CI",
"arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${ProjectName}"
],
"Action": [
Expand All @@ -133,10 +199,10 @@ Resources:
"Resource": [
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}",
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}:*",
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}-test-release",
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}-test-release:*",
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}-prod-release",
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}-prod-release:*"
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}-CI",
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}-CI:*",
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}-Release",
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}-Release:*"
],
"Action": [
"logs:CreateLogGroup",
Expand Down Expand Up @@ -176,14 +242,32 @@ Resources:
Type: "AWS::SSM::Parameter"
Properties:
Description: Parameter to store our account id so CodeBuild specs can access it
Name: /CodeBuild/AccountId
Name: /CodeBuild/AccountIdentity
Type: String
Value: !Sub "${AWS::AccountId}"
SecretsManagerPolicy:
SecretsManagerPolicyCI:
Type: "AWS::IAM::ManagedPolicy"
Properties:
ManagedPolicyName: !Sub "CryptoTools-SecretsManager-${ProjectName}-release"
Path: /service-role/
ManagedPolicyName: !Sub "CryptoTools-SecretsManager-${ProjectName}-CI"
Path: "/service-role/"
PolicyDocument: !Sub |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Resource": [
"arn:aws:secretsmanager:us-west-2:${AWS::AccountId}:secret:Maven-GPG-Keys-GC6h0A"
],
"Action": "secretsmanager:GetSecretValue"
}
]
}
SecretsManagerPolicyRelease:
Type: "AWS::IAM::ManagedPolicy"
Properties:
ManagedPolicyName: !Sub "CryptoTools-SecretsManager-${ProjectName}-Release"
Path: "/service-role/"
PolicyDocument: !Sub |
{
"Version": "2012-10-17",
Expand All @@ -192,8 +276,7 @@ Resources:
"Effect": "Allow",
"Resource": [
"arn:aws:secretsmanager:us-west-2:${AWS::AccountId}:secret:Maven-GPG-Keys-GC6h0A",
"arn:aws:secretsmanager:us-west-2:${AWS::AccountId}:secret:Sonatype-Team-Account-0tWvZm",
"arn:aws:secretsmanager:us-west-2:587316601012:secret:Maven-GPG-Keys-Credentials-C0wCzI",
"arn:aws:secretsmanager:us-west-2:${AWS::AccountId}:secret:Sonatype-Team-Account-0tWvZm"
],
"Action": "secretsmanager:GetSecretValue"
}
Expand Down Expand Up @@ -226,7 +309,7 @@ Resources:
ParameterStorePolicy:
Type: "AWS::IAM::ManagedPolicy"
Properties:
ManagedPolicyName: !Sub "CryptoTools-ParameterStore-${ProjectName}-release"
ManagedPolicyName: !Sub "CryptoTools-ParameterStore-${ProjectName}"
Path: /service-role/
PolicyDocument: !Sub |
{
Expand Down