Prod_CodeBuild_PR_Merge.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: Template creates Codebuild resources for a simple SAM Application
Parameters:
  RepoParam:
    Type: String
    Description: Enter the GitHub URL for the repo

  UtilRepoParam:
    Type: String
    Description: Enter the GitHub URL for the LzSmfRepo

  ProdStackNameParam:
    Type: String
    Default: Prod

Resources:
  S3:
    Type: "AWS::S3::Bucket"
    Properties: 
      BucketName: !Sub "${AWS::StackName}-${AWS::AccountId}"

  CodeBuild:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub "${AWS::StackName}"
      Description: Build process for .NET Serverless Application
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Artifacts:
        Type: S3
        Location: !Ref S3
        Name: !Sub "${AWS::StackName}-build-artifacts"
        Path: ''
        NamespaceType: NONE
        Packaging: NONE
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:5.0
      SecondarySources:
        - Type: GITHUB
          Location: !Ref UtilRepoParam
          GitCloneDepth: 1
          SourceIdentifier: LzSmfUtil
      SourceVersion: "main"
      Source:
        Location: !Ref RepoParam
        Type: GITHUB
        GitCloneDepth: 1
        BuildSpec: !Sub |
          version: 0.2
          env:
            git-credential-helper: yes
          phases:
            build:
              commands:
                # build all Lambda projects (and their dependencies)
                - for proj in Lambdas/*/*.csproj; do eval "dotnet build $proj --configuration Release";  done
                - eval "sam deploy -t Stacks/Prod/serverless.template --stack-name ${ProdStackNameParam} --s3-bucket ${S3} --capabilities CAPABILITY_NAMED_IAM --region ${AWS::Region}"
                - pwsh -Command  "../LazyStackSmfUtil/GetAwsSettings $stack Stacks/Prod/AwsSettings.json"
                - git config user.name "CodeBuild"
                - git config user.email CodeBuild@example.com
                - git checkout main
                - git add Stacks/Prod/AwsSettings.json
                - git commit -m "Update AwsSettings.json for Prod Stack"
                - git push --set-upstream origin HEAD:main
      Triggers:
        Webhook: true
        FilterGroups:
          - - Type: EVENT
              Pattern: PUSH
              ExcludeMatchedPattern: false
            - Type: HEAD_REF 
              Pattern: ^refs/heads/main$

      BadgeEnabled: false
      LogsConfig:
        CloudWatchLogs: 
          Status: ENABLED
        S3Logs:
          Status: DISABLED
          EncryptionDisabled: false
      TimeoutInMinutes: 10
  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "CodeBuildRole-prod-pr-merge-${AWS::StackName}"
      Description: Provides Codebuild permission to access API GW, Lambda and Cloudformation
      #Provide Codebuild permission to assume this role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: "Allow"
          Principal:
            Service: "codebuild.amazonaws.com"
          Action: "sts:AssumeRole"

  # This can be restricted more
  CodeBuildPolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: !Sub "CodeBuildPolicy-prod-pr-merge-${AWS::StackName}"
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'cognito-idp:*'
            Resource:
              - "*"

          - Effect: Allow
            Action:
              - 'cognito-identity:*'
            Resource:
              - "*"

          - Effect: Allow
            Action:
              - 'dynamodb:UpdateTable'
              - 'dynamodb:DescribeTable'
              - 'dynamodb:DeleteTable'
              - 'dynamodb:CreateTable'
            Resource:
              - !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/*'

          - Effect: Allow
            Action:
              - 'cloudformation:CreateChangeSet'
            Resource:
              - 'arn:aws:cloudformation:*:aws:transform/Serverless-2016-10-31'

          - Effect: Allow
            Action:
              - 'cloudformation:CreateChangeSet'
              - 'cloudformation:DeleteStack'
              - 'cloudformation:DescribeChangeSet'
              - 'cloudformation:DescribeStackEvents'
              - 'cloudformation:DescribeStacks'
              - 'cloudformation:ExecuteChangeSet'
              - 'cloudformation:GetTemplateSummary'
              - 'cloudformation:DescribeStackResources'
              - 'cloudformation:GetTemplate'
            Resource:
              - !Sub 'arn:aws:cloudformation:*:${AWS::AccountId}:stack/*'

          - Effect: Allow
            Action:
              - 's3:CreateBucket'
              - 's3:GetObject'
              - 's3:PutObject'
            Resource:
              - 'arn:aws:s3:::*/*'

          - Effect: Allow
            Action:
              - 'ecr:BatchCheckLayerAvailability'
              - 'ecr:BatchGetImage'
              - 'ecr:CompleteLayerUpload'
              - 'ecr:DescribeImages'
              - 'ecr:DescribeRepositories'
              - 'ecr:GetDownloadUrlForLayer'
              - 'ecr:GetRepositoryPolicy'
              - 'ecr:InitiateLayerUpload'
              - 'ecr:ListImages'
              - 'ecr:PutImage'
              - 'ecr:SetRepositoryPolicy'
              - 'ecr:UploadLayerPart'
            Resource:
              - !Sub 'arn:aws:ecr:*:${AWS::AccountId}:repository/*'

          - Effect: Allow
            Action:
              - 'ecr:GetAuthorizationToken'
            Resource:
              - '*'

          - Effect: Allow
            Action:
              - 'lambda:AddPermission'
              - 'lambda:CreateFunction'
              - 'lambda:DeleteFunction'
              - 'lambda:GetFunction'
              - 'lambda:GetFunctionConfiguration'
              - 'lambda:ListTags'
              - 'lambda:RemovePermission'
              - 'lambda:TagResource'
              - 'lambda:UntagResource'
              - 'lambda:UpdateFunctionCode'
              - 'lambda:UpdateFunctionConfiguration'
            Resource:
              - !Sub 'arn:aws:lambda:*:${AWS::AccountId}:function:*'

          - Effect: Allow
            Action:
              - 'iam:AttachRolePolicy'
              - 'iam:CreateRole'
              - 'iam:DeleteRole'
              - 'iam:DeleteRolePolicy'
              - 'iam:DetachRolePolicy'
              - 'iam:GetRole'
              - 'iam:GetRolePolicy'
              - 'iam:PutRolePolicy'
              - 'iam:PassRole'
              - 'iam:TagRole'
              - 'iam:CreateServiceLinkedRole'              
            Resource:
              - !Sub 'arn:aws:iam::${AWS::AccountId}:role/*'

          - Effect: Allow
            Action:
              - 'apigateway:*'
            Resource:
              - !Sub 'arn:aws:apigateway:*:*:/*'

          - Effect: Allow
            Action:
              - 'logs:DescribeQueries'
              - 'logs:GetLogRecord'
              - 'logs:PutDestinationPolicy'
              - 'logs:StopQuery'
              - 'logs:TestMetricFilter'
              - 'logs:DeleteDestination'
              - 'logs:GetLogDelivery'
              - 'logs:ListLogDeliveries'
              - 'logs:CreateLogDelivery'
              - 'logs:DeleteResourcePolicy'
              - 'logs:PutResourcePolicy'
              - 'logs:DescribeExportTasks'
              - 'logs:GetQueryResults'
              - 'logs:UpdateLogDelivery'
              - 'logs:CancelExportTask'
              - 'logs:DeleteLogDelivery'
              - 'logs:PutDestination'
              - 'logs:DescribeResourcePolicies'
              - 'logs:DescribeDestinations'
            Resource: '*'

          - Effect: Allow
            Action: 'logs:*'
            Resource: !Sub 'arn:aws:logs:*:${AWS::AccountId}:log-group:*'

          - Effect: Allow
            Action: 'logs:*'
            Resource: !Sub 'arn:aws:logs:*:${AWS::AccountId}:log-group:*:log-stream:*'
      Roles:
        -  !Ref CodeBuildRole