template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Description: >-
  This template creates IAM roles and use them to setup CD pipeline for the backend service.

Parameters:
  GitHubOAuthTokenSecretId:
    Type: String
    Description: The AWS Secrets Manager Secret Id that stores Github OAuth token.
    Default: 'GitHubOAuthToken'
  GitHubOwner:
    Type: String
    Description: The GitHub owner of the repository.
    Default: 'awslabs'
  ApplicationStackName:
    Type: String
    Description: The stack name the CD pipeline will use to deploy the application.
    Default: 'realworld-serverless-application-backend'
  Stage:
    Type: String
    Description: The stage where the application is running in, e.g., dev, prod.
    Default: 'dev'
Resources:
  CD:
    Type: 'AWS::Serverless::Application'
    Properties:
      Location:
        ApplicationId: arn:aws:serverlessrepo:us-east-1:646794253159:applications/aws-sam-codepipeline-cd
        SemanticVersion: 0.1.3
      Parameters:
        GitHubOAuthToken: !Sub '{{resolve:secretsmanager:${GitHubOAuthTokenSecretId}}}'
        GitHubOwner: !Ref GitHubOwner
        GitHubRepo: realworld-serverless-application
        DeployStackName: !Ref ApplicationStackName
        DeployRoleName: !Ref DeployRole
        DeployParameterOverrides: !Sub '{"Stage":"${Stage}"}'
        IntegTestRoleName: !Ref IntegTestsRole
        BuildSpecFilePath: 'backend/buildspec.yaml'
        IntegTestBuildSpecFilePath: 'backend/buildspec-integ-test.yaml'

  # This policy defines the minimum IAM permissions required to Create and Delete a stack for backend component into CloudFormation
  CloudFormationDeployPolicy:
    Type: AWS::IAM::Policy
    Properties:
      Roles:
        - !Ref IntegTestsRole
        - !Ref DeployRole
      PolicyName: "deploy-create-delete-access"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action:
              - cloudformation:CreateChangeSet
            Resource:
              - !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:aws:transform/Serverless-2016-10-31
              - !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:aws:transform/Include
          - Effect: "Allow"
            Action:
              - dynamodb:DescribeTable
              - dynamodb:DeleteTable
              - dynamodb:CreateTable
              - dynamodb:UpdateContinuousBackups
              - dynamodb:DescribeContinuousBackups
              - dynamodb:UpdateTimeToLive
              - dynamodb:DescribeTimeToLive
              - dynamodb:TagResource
              - dynamodb:ListTagsOfResource
            Resource:
              - !Sub arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/*
          - Effect: "Allow"
            Action:
              - iam:CreateRole
              - iam:DeleteRole
              - iam:GetRole
              - iam:TagRole
              - iam:PutRolePolicy
              - iam:GetRolePolicy
              - iam:DeleteRolePolicy
              - iam:AttachRolePolicy
              - iam:DetachRolePolicy
              - iam:PassRole
            Resource:
              - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/*
          - Effect: "Allow"
            Action:
              - apigateway:*
            Resource:
              - !Sub arn:${AWS::Partition}:apigateway:${AWS::Region}::/restapis/*
          - Effect: "Allow"
            Action:
              - apigateway:POST
            Resource:
              - !Sub arn:${AWS::Partition}:apigateway:${AWS::Region}::/restapis
          - Effect: "Allow"
            Action:
              - apigateway:PATCH
              - apigateway:GET
            Resource:
              - !Sub arn:${AWS::Partition}:apigateway:${AWS::Region}::/account
          - Effect: "Allow"
            Action:
              - codedeploy:CreateApplication
              - codedeploy:DeleteApplication
            Resource:
              - !Sub arn:${AWS::Partition}:codedeploy:${AWS::Region}:${AWS::AccountId}:application:*
          - Effect: "Allow"
            Action:
              - codedeploy:CreateDeploymentGroup
              - codedeploy:DeleteDeploymentGroup
              - codedeploy:CreateDeployment
            Resource:
              - !Sub arn:${AWS::Partition}:codedeploy:${AWS::Region}:${AWS::AccountId}:deploymentgroup:*
          - Effect: "Allow"
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:CreateGrant
              - kms:DescribeKey
              - kms:GenerateDataKey
            Resource:
              - !Sub arn:${AWS::Partition}:kms:${AWS::Region}:${AWS::AccountId}:aliases/aws/lambda
          - Effect: "Allow"
            Action:
              - kms:CreateKey
            Resource:
              - '*'
          - Effect: "Allow"
            Action:
              - kms:PutKeyPolicy
              - kms:DescribeKey
              - kms:ScheduleKeyDeletion
              - kms:EnableKeyRotation
              - kms:TagResource
              - kms:UntagResource
              - kms:ListResourceTags
            Resource:
              - !Sub arn:${AWS::Partition}:kms:${AWS::Region}:${AWS::AccountId}:key/*
          - Effect: "Allow"
            Action:
              - lambda:CreateFunction
              - lambda:GetFunctionConfiguration
              - lambda:GetFunction
              - lambda:DeleteFunction
              - lambda:CreateAlias
              - lambda:GetAlias
              - lambda:DeleteAlias
              - lambda:PublishVersion
              - lambda:ListVersionsByFunction
              - lambda:AddPermission
              - lambda:RemovePermission
            Resource:
              - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:*
          - Effect: "Allow"
            Action:
              - logs:DescribeLogGroups
            Resource:
              - !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:*
          - Effect: "Allow"
            Action:
              - logs:CreateLogGroup
              - logs:DescribeLogGroups
              - logs:DeleteLogGroup
              - logs:PutRetentionPolicy
            Resource:
              - !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/apigateway/AccessLog-*
          - Effect: "Allow"
            Action:
              - ssm:PutParameter
              - ssm:DeleteParameter
              - ssm:GetParameters
              - ssm:GetParametersByPath
              - ssm:AddTagsToResource
              - ssm:RemoveTagsFromResource
            Resource:
              - !Sub arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/applications/apprepo/*
          - Effect: "Allow"
            Action:
              - cognito-idp:CreateUserPool
              - cognito-idp:DeleteUserPool
            Resource:
              - !Sub arn:${AWS::Partition}:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/*
          - Effect: "Allow"
            Action:
              - cognito-idp:CreateUserPool
            Resource:
              - "*"
          - Effect: "Allow"
            Action:
              - cloudwatch:PutMetricAlarm
              - cloudwatch:DescribeAlarms
              - cloudwatch:DeleteAlarms
            Resource:
              - !Sub arn:${AWS::Partition}:cloudwatch:${AWS::Region}:${AWS::AccountId}:alarm:*
  # This role is used to deploy backend to CloudFormation.
  # In addition to the permissions from CloudFormationDeployPolicy, it also defines permissions that is required to update the stack in CloudFormation
  DeployRole:
    Type: "AWS::IAM::Role"
    Properties:
      Description: !Sub "Deploy CloudFormation stack ${ApplicationStackName}. Created by CloudFormation ${AWS::StackId}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "cloudformation.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: "dynamodb-update-access"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - dynamodb:UpdateTable
                Resource:
                  - !Sub arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/*
        - PolicyName: "iam-update-access"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - iam:UpdateRoleDescription
                  - iam:UpdateRole
                Resource:
                  - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/*
        - PolicyName: "codedeploy-update-access"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - codedeploy:UpdateApplication
                  - codedeploy:RegisterApplicationRevision
                Resource:
                  - !Sub arn:${AWS::Partition}:codedeploy:${AWS::Region}:${AWS::AccountId}:application:*
              - Effect: "Allow"
                Action:
                  - codedeploy:UpdateDeploymentGroup
                  - codedeploy:GetDeployment
                Resource:
                  - !Sub arn:${AWS::Partition}:codedeploy:${AWS::Region}:${AWS::AccountId}:deploymentgroup:*
              - Effect: "Allow"
                Action:
                  - codedeploy:GetDeploymentConfig
                Resource:
                  - !Sub arn:${AWS::Partition}:codedeploy:${AWS::Region}:${AWS::AccountId}:deploymentconfig:CodeDeployDefault.Lambda*
        - PolicyName: "lambda-update-access"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - lambda:UpdateFunctionConfiguration
                  - lambda:UpdateFunctionCode
                  - lambda:UpdateAlias
                  - lambda:ListTags
                  - lambda:TagResource
                  - lambda:UntagResource
                Resource:
                  - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:*
        - PolicyName: "cognito-update-access"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - cognito-idp:UpdateUserPool
                  - cognito-idp:DescribeUserPool
                Resource:
                  - !Sub arn:${AWS::Partition}:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/*
  # This role is used to run integration tests in CodeBuild.
  # In addition to the permissions from CloudFormationDeployPolicy, it also defines permissions that is required by integration tests only.
  IntegTestsRole:
    Type: "AWS::IAM::Role"
    Properties:
      Description: !Sub "Runs integration tests in CodeBuild for ${ApplicationStackName}. Created by CloudFormation ${AWS::StackId}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "codebuild.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: "cloudformation-access"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - cloudformation:DescribeStacks
                  - cloudformation:CreateChangeSet
                  - cloudformation:ExecuteChangeSet
                  - cloudformation:DescribeChangeSet
                  - cloudformation:DeleteStack
                Resource:
                  - !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${ApplicationStackName}-integ-tests*
        - PolicyName: "cognito-access"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
            - Effect: "Allow"
              Action:
                - cognito-idp:CreateUserPoolClient
                - cognito-idp:DeleteUserPoolClient
                - cognito-idp:AdminConfirmSignUp
                - cognito-idp:AdminInitiateAuth
                - cognito-idp:AdminDeleteUser
              Resource:
                - !Sub arn:${AWS::Partition}:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/*