cloudformation.yml

---
AWSTemplateFormatVersion: 2010-09-09
Description: "deploy-account.pipeline.side8"
Parameters:
  Environment:
    Type: String

  Side8Id:
    Type: String

  AccountId:
    Type: String

Conditions:
  AccountsMatch: !Equals
    - !Ref AccountId
    - !Ref AWS::AccountId

Resources:
  Side8PipelineIamRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub side8.pipeline.deploy.${Side8Id}
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          Effect: Allow
          Principal:
            AWS: arn:aws:iam::265928549752:root
          Action: sts:AssumeRole
          Condition:
            StringEquals:
              sts:ExternalId: !Ref Side8Id
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AdministratorAccess'
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'

  AccountsMatch:
    Type: Custom::AccountsMatch
    Properties:
      ServiceToken: !GetAtt FailFalseLambdaFunction.Arn
      Boolean: !If [AccountsMatch, true, false]
      FailMessage: "Account mismatch. Do you need to switch accounts?"

  BasicLambdaFunctionIamRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'

  FailFalseLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler: "index.handler"
      Role: !GetAtt BasicLambdaFunctionIamRole.Arn
      Runtime: "python3.7"
      Code:
        ZipFile: |
          from botocore.vendored import requests
          import json
          def handler(event, context):
              try:
                  boolean = json.loads(event["ResourceProperties"].get("Boolean", "false"))
              except json.decoder.JSONDecodeError:
                  boolean = False
              status = "SUCCESS" if boolean or event["RequestType"] == "Delete" else "FAILED"
              message = None if status == "SUCCESS" else event["ResourceProperties"].get("FailMessage")
              response = requests.put(event['ResponseURL'],
                                      json={
                                          "Status": status,
                                          "StackId": event['StackId'],
                                          "RequestId": event['RequestId'],
                                          "LogicalResourceId": event['LogicalResourceId'],
                                          "PhysicalResourceId": f"""{event['LogicalResourceId']}-{status}""",
                                          **({"Reason": message} if message is not None else {}),
                                      })
              response.raise_for_status()
              return response.text