cicd.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: >
  Continuous Deployment settings for github-app-token

Parameters:
  Environment:
    Type: String
    AllowedValues:
      - production
      - staging

Resources:
  # Permission Boundary for Roles
  PermissionsBoundary:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Permission Boundary for github-app-token Roles
      ManagedPolicyName: !Sub "github-app-token-permissions-boundary-${AWS::Region}"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: ServiceBoundaries
            Effect: Allow
            Action:
              - "logs:*"
              - "ssm:*"
              - "xray:*"
            Resource: "*"

  # CloudFormation Service Role for deploying SAM templates
  DeploymentRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "github-app-token-cfn-service-role-${AWS::Region}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - cloudformation.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: deploy-sam-templates
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: CreateOrChangeOnlyWithBoundary
                Effect: Allow
                Action:
                  - "iam:CreateRole"
                  - "iam:PutRolePolicy"
                  - "iam:AttachRolePolicy"
                  - "iam:DetachRolePolicy"
                  - "iam:DeleteRolePolicy"
                  - "iam:PutRolePermissionsBoundary"
                Resource: "*"
                Condition:
                  StringEquals:
                    "iam:PermissionsBoundary": !Ref PermissionsBoundary
              - Sid: NoBoundaryPolicyEdit
                Effect: Deny
                Action:
                  - "iam:CreatePolicyVersion"
                  - "iam:DeletePolicy"
                  - "iam:DeletePolicyVersion"
                  - "iam:SetDefaultPolicyVersion"
                Resource:
                  - !Ref PermissionsBoundary
              - Sid: NoBoundaryRoleDelete
                Effect: Deny
                Action:
                  - "iam:DeleteRolePermissionsBoundary"
                Resource: "*"
              - Sid: OtherIAMTasks
                Effect: Allow
                Resource: "*"
                Action:
                  # handle IAM Roles
                  - "iam:ListRolePolicies"
                  - "iam:ListRoleTags"
                  - "iam:ListRoles"
                  - "iam:GetRole"
                  - "iam:GetRolePolicy"
                  - "iam:ListAttachedRolePolicies"
                  - "iam:UpdateRole"
                  - "iam:UpdateRoleDescription"
                  - "iam:UpdateAssumeRolePolicy"
                  - "iam:TagRole"
                  - "iam:UntagRole"
                  - "iam:DeleteRole"
                  - "iam:PassRole"

                  # handle Service Linked Roles
                  - "iam:ListPoliciesGrantingServiceAccess"
                  - "iam:CreateServiceLinkedRole"
                  - "iam:DeleteServiceLinkedRole"
                  - "iam:GetServiceLinkedRoleDeletionStatus"

              - Sid: CloudFormationStackOperation
                Effect: Allow
                Action:
                  - "cloudformation:*"
                  - "lambda:*"
                  - "apigateway:*"
                  - "ssm:*"
                  - "s3:*"
                Resource:
                  - "*"

  # for GitHub Actions
  GitHubActionsRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "github-app-token-github-actions-${AWS::Region}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::053160724612:root
            Action: "sts:AssumeRole"
            Condition:
              StringEquals:
                "sts:ExternalId": "R_kgDOF8HFZg"
                "aws:RequestTag/Environment": !Ref Environment
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::053160724612:root
            Action: "sts:TagSession"
      Policies:
        - PolicyName: SAMDeployment
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: PassRoleToCloudFormation
                Effect: Allow
                Action: "iam:PassRole"
                Resource: !GetAtt DeploymentRole.Arn
              - Sid: CloudFormationStackOperation
                Effect: Allow
                Action: "cloudformation:*"
                Resource:
                  - !Sub "arn:aws:cloudformation:us-east-1:${AWS::AccountId}:stack/github-app-token/*"
              - Sid: CloudFormationDenyImport
                Effect: Deny
                Action: "cloudformation:*"
                Resource: "*"
                Condition:
                  "ForAnyValue:StringLike":
                    "cloudformation:ImportResourceTypes": ["*"]
              - Sid: S3Operation
                Effect: Allow
                Action: "s3:*"
                Resource: "arn:aws:s3:::aws-sam-cli-managed-default-samclisourcebucket-*/*"
              - Sid: S3ListOperation
                Effect: Allow
                Action: "s3:ListBucket"
                Resource: "arn:aws:s3:::aws-sam-cli-managed-default-samclisourcebucket-*"