cf-configstack.json

{
  "AWSTemplateFormatVersion": "2010-09-09",

  "Description" : "Cheapseats Core Configuration and Supporting Infrastructure",
  
  "Parameters" : {
    "CreateBucket" : {
      "Type" : "String",
      "Description" : "Create a new S3 buckets?",
      "AllowedValues" : ["Yes", "No"],
      "Default" : "Yes"
    },
    "CreateRoles" : {
      "Type" : "String",
      "Description" : "Provision IAM Roles and Policies for Build Pipeline",
      "AllowedValues" : ["Yes", "No"],
      "Default" : "No"
    },
    "ConfigBucketName" : {
       "Type" : "String",
       "Description" : "S3 Bucket for Configuration Artifacts & Templates",
       "Default" : "bucket_name_here"
    },
    "LoggingBucketName" : {
      "Type" : "String",
      "Description" : "S3 Bucket for Configuration Artifacts & Templates",
      "Default" : "bucket_name_here"
   },
    "ArtifactPrefix" : {
       "Type" : "String",
       "Description" : "Key Prefix for Deployment Artifacts",
       "Default" : "Build/Artifacts"
    },
    "ResourcesPrefix" : {
       "Type" : "String",
       "Description" : "Key Prefix for Resource Files",
       "Default" : "Resources"
    }
  },
  
  "Conditions" : {
    "ShouldCreateBucket" : { "Fn::Equals" : [ { "Ref" : "CreateBucket" }, "Yes" ] },
    "ShouldCreateRoles" : { "Fn::Equals" : [ { "Ref" : "CreateRoles" }, "Yes" ] }
  },
  
  "Resources" : {
    "ConfigBucketObject" : {
      "Type" : "AWS::S3::Bucket",
      "Condition" : "ShouldCreateBucket",
      "DeletionPolicy" : "Retain",
      "UpdateReplacePolicy" : "Retain",
      "Properties" : {
      }
    },
  
    "ConfigBucketParam" : {
      "Type" : "AWS::SSM::Parameter",
      "Properties" : {
        "Name" : "/CheapSeats/Env/ConfigBucket",
        "Type" : "String",
        "Value" : { "Fn::If" : [ "ShouldCreateBucket", { "Ref" : "ConfigBucketObject" }, { "Ref" : "LoggingBucketName" } ] }
      }
    },  

    "ArtifactPrefixParam" : {
      "Type" : "AWS::SSM::Parameter",
      "Properties" : {
        "Name" : "/CheapSeats/Env/ConfigBucket/ArtifactPrefix",
        "Type" : "String",
        "Value" : { "Ref" : "ArtifactPrefix" }
      }
    },

    "LoggingBucketObject" : {
      "Type" : "AWS::S3::Bucket",
      "Condition" : "ShouldCreateBucket",
      "DeletionPolicy" : "Retain",
      "UpdateReplacePolicy" : "Retain",
      "Properties" : {
      }
    },

    "LoggingBucketParam" : {
      "Type" : "AWS::SSM::Parameter",
      "Properties" : {
        "Name" : "/CheapSeats/Env/LoggingBucket",
        "Type" : "String",
        "Value" : { "Fn::If" : [ "ShouldCreateBucket", { "Ref" : "LoggingBucketObject" }, { "Ref" : "LoggingBucketName" } ] }
      }
    },  

    
    "CodeBuildPolicy" : {
      "Type" : "AWS::IAM::ManagedPolicy",
      "Condition" : "ShouldCreateRoles",
      "Properties" : {
        "ManagedPolicyName" : "CheapseatsVpcBuildPolicy",
        "Description" : "IAM Deployment Permissions required to prepare VPC deployment artifacts via CodeBuild",
        "Path" : "/cheapseats/vpc/",
        "PolicyDocument" : {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "SSMParameterAccess",
              "Effect": "Allow",
              "Action": [
                "ssm:GetParameter",
                "ssm:GetParameters",
                "ssm:PutParameter",
                "ssm:DeleteParameter",
                "ssm:AddTagsToResource",
                "ssm:RemoveTagsFromResource"
              ],
              "Resource": { "Fn::Sub" : "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/CheapSeats/*" }
            },
            {
              "Sid": "S3DeploymentAccess",
              "Effect": "Allow",
              "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:ListBucket",
                "s3:PutObject"
              ],
              "Resource": [
                { "Fn::Sub" : "arn:aws:s3:::${ConfigBucketName}" }
              , { "Fn::Sub" : "arn:aws:s3:::codepipeline-${AWS::Region}-*" }
              , { "Fn::Sub" : "arn:aws:s3:::${ConfigBucketName}/${ArtifactPrefix}/*" } 
              , { "Fn::Sub" : "arn:aws:s3:::${ConfigBucketName}/${ResourcesPrefix}/*" } 
              ]
            },
            {
              "Effect": "Allow",
              "Action": [
                "ec2:CreateNetworkInterface",
                "ec2:DescribeDhcpOptions",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DeleteNetworkInterface",
                "ec2:DescribeSubnets",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeVpcs",
                "cloudformation:ValidateTemplate",
                "kms:DescribeKey"
              ],
              "Resource": "*"
            },
            {
              "Effect": "Allow",
              "Action": [
                "ec2:CreateNetworkInterfacePermission"
              ],
              "Resource": "arn:aws:ec2:ap-southeast-2:495602461790:network-interface/*",
              "Condition": {
                "StringEquals": {
                  "ec2:AuthorizedService": "codebuild.amazonaws.com"
                }
              }
            },
            {
              "Effect" : "Allow",
              "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
              ],              
              "Resource": [
                 { "Fn::Sub" : "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*" }
              ]
            }
          ]
        }
      }
    },
    
    "CodeBuildRole" : {
      "Type" : "AWS::IAM::Role",
      "Condition" : "ShouldCreateRoles",
      "Properties" : {
        "RoleName" : "CheapseatsVpcCodeBuildRole",
        "Description" : "IAM Role for CheapSeats packaging activities via CodeBuild",
        "AssumeRolePolicyDocument" : {
          "Version" : "2012-10-17",
          "Statement" : [ {
            "Effect" : "Allow",
            "Principal" : {
              "Service" : [ "codebuild.amazonaws.com" ]
            },
            "Action" : [ "sts:AssumeRole" ]
          } ]
        },
        "Path" : "/cheapseats/vpc/",
        "ManagedPolicyArns" : [
          { "Ref" : "CodeBuildPolicy" }
        ]
      }
    },
    
    "CloudFormationPolicy" : {
      "Type" : "AWS::IAM::ManagedPolicy",
      "Condition" : "ShouldCreateRoles",
      "Properties" : {
        "ManagedPolicyName" : "CheapseatsVpcDeployPolicy",
        "Description" : "IAM Deployment Permissions required to provision VPC via CloudFormation",
        "Path" : "/cheapseats/vpc/",
        "PolicyDocument" : {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "DeimosCoreVPCAccess",
              "Effect": "Allow",
              "Action": [
                "ec2:AttachInternetGateway",
                "ec2:DetachInternetGateway",
                "ec2:CreateInternetGateway",
                "ec2:DeleteInternetGateway",
                "ec2:CreateVpc",
                "ec2:CreateSubnet",
                "ec2:CreateRoute",
                "ec2:CreateRouteTable",
                "ec2:CreateTags",
                "ec2:DeleteVpc",
                "ec2:DeleteSubnet",
                "ec2:DeleteRoute",
                "ec2:DeleteRouteTable",
                "ec2:DeleteTags",
                "ec2:AssociateRouteTable",
                "ec2:DisassociateRouteTable",
                "ec2:ReplaceRoute",
                "ec2:ReplaceRouteTableAssociation",
                "ec2:AllocateAddress",
                "ec2:ReleaseAddress",
                "ec2:ModifyVpcAttribute",
                "ec2:ModifySubnetAttribute",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:UpdateSecurityGroupRuleDescriptionsEgress",
                "ec2:CreateSecurityGroup",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:DeleteSecurityGroup",
                "ec2:UpdateSecurityGroupRuleDescriptionsIngress",
                "ec2:Describe*"
              ],
              "Resource": "*"
            },
            {
              "Sid": "SSMParameterAccess",
              "Effect": "Allow",
              "Action": [
                "ssm:GetParameter",
                "ssm:GetParameters",
                "ssm:PutParameter",
                "ssm:DeleteParameter",
                "ssm:AddTagsToResource",
                "ssm:RemoveTagsFromResource"
              ],
              "Resource": { "Fn::Sub" : "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/CheapSeats/*" }
            },
            {
              "Sid": "S3DeploymentAccess",
              "Effect": "Allow",
              "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:ListBucket"
              ],
              "Resource": [
                { "Fn::Sub" : "arn:aws:s3:::${ConfigBucketName}" }
              , { "Fn::Sub" : "arn:aws:s3:::${ConfigBucketName}/${ArtifactPrefix}/*" } 
              , { "Fn::Sub" : "arn:aws:s3:::${ConfigBucketName}/${ResourcesPrefix}/*" } 
              ]
            },
            {
              "Sid": "LambdaCreation",
              "Effect": "Allow",
              "Action": [
                "lambda:CreateFunction",
                "lambda:UpdateFunctionCode",
                "lambda:AddPermission",
                "lambda:GetFunction",
                "lambda:UpdateFunctionConfiguration",
                "lambda:GetFunctionConfiguration",
                "lambda:DeleteFunction",
                "lambda:PublishVersion",
                "lambda:GetPolicy",
                "lambda:RemovePermission",
                "lambda:ListTags",
                "lambda:TagResource",
                "lambda:UntagResource",
                "lambda:PutFunctionConcurrency",
                "lambda:DeleteFunctionConcurrency"
              ],
              "Resource": { "Fn::Sub" : "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:*" }
            },
            {
              "Sid": "EventCreation",
              "Effect": "Allow",
              "Action" : [
                "events:*Rule",
                "events:*Targets",
                "events:Tag*",
                "events:Untag*"
              ],
              "Resource" : { "Fn::Sub" : "arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/*" }
            },
            {
              "Sid": "DeimosCoreIAM",
              "Effect": "Allow",
              "Action": [
                "iam:GetRole",
                "iam:UpdateAssumeRolePolicy",
                "iam:PassRole",
                "iam:GetPolicy",
                "iam:GetRole",
                "iam:DeleteRolePolicy",
                "iam:DeletePolicy",
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:AttachRolePolicy",
                "iam:DetachRolePolicy",
                "iam:UpdateRole",
                "iam:PutRolePolicy",
                "iam:GetRolePolicy",
                "iam:ListRoleTags",
                "iam:TagRole",
                "iam:UntagRole"
              ],
              "Resource": [
                 { "Fn::Sub" : "arn:aws:iam::${AWS::AccountId}:role/cheapseats/*" }
              ,  { "Fn::Sub" : "arn:aws:iam::${AWS::AccountId}:policy/cheapseats/*" }
              ]
        }
          ]
        }
      }
    },
    
    
    "CloudFormationRole" : {
      "Type" : "AWS::IAM::Role",
      "Condition" : "ShouldCreateRoles",
      "Properties" : {
        "RoleName" : "CheapseatsVpcCloudFormationRole",
        "Description" : "IAM Role for CheapSeats deployment via CloudFormation",
        "AssumeRolePolicyDocument" : {
          "Version" : "2012-10-17",
          "Statement" : [ {
            "Effect" : "Allow",
            "Principal" : {
              "Service" : [ "cloudformation.amazonaws.com" ]
            },
            "Action" : [ "sts:AssumeRole" ]
          } ]
        },
        "Path" : "/cheapseats/vpc/",
        "ManagedPolicyArns" : [
          { "Ref" : "CloudFormationPolicy" }
        ]
      }
    }
  },
  
  "Outputs" : {
    "ConfigBucket" : {
      "Description" : "Configuration S3 Bucket",
      "Value" : { "Fn::If" : [ "ShouldCreateBucket", { "Ref" : "ConfigBucketObject" }, { "Ref" : "ConfigBucketName" } ] },
      "Export" : {
        "Name" : "CheapSeats-ConfigBucket"
      }
    },
    "ArtifactPrefix" : {
      "Description" : "Prefix for Configuration Artifacts",
      "Value" : { "Ref" : "ArtifactPrefix" },
      "Export" : {
        "Name" : "CheapSeats-ConfigBucket-ArtifactPrefix"
      }
    },
    "ResourcesPrefix" : {
      "Description" : "Prefix for Resource Files",
      "Value" : { "Ref" : "ResourcesPrefix" },
      "Export" : {
        "Name" : "CheapSeats-ConfigBucket-ResourcesPrefix"
      }
    },
    "ArtifactPrefixLegacy" : {
      "Description" : "Prefix for Configuration Artifacts",
      "Value" : { "Ref" : "ArtifactPrefix" },
      "Export" : {
        "Name" : "CheapSeats-ArtifactPrefix"
      }
    },
    "ResourcesPrefixLegacy" : {
      "Description" : "Prefix for Resource Files",
      "Value" : { "Ref" : "ResourcesPrefix" },
      "Export" : {
        "Name" : "CheapSeats-ResourcesPrefix"
      }
    },
    "LoggingBucket" : {
      "Description" : "Logging S3 Bucket",
      "Value" : { "Fn::If" : [ "ShouldCreateBucket", { "Ref" : "LoggingBucketObject" }, { "Ref" : "LoggingBucketName" } ] },
      "Export" : {
        "Name" : "CheapSeats-LoggingBucket"
      }
    }
  }
}