build_template.yml

---
Description: >-
  Pipeline to release Lambda layers publicly when new release is created

Metadata:
  Author: https://github.com/johnpreston

Parameters:
  BlogDistributionId:
    Type: String
  BlogBucketName:
    Type: String
  TmpBlogBucketName:
    Type: String
  CVSProviderUrl:
    Type: String
    Description: Name of VCS repo for the Docker composeX file
    Default: https://github.com/
  BranchName:
    Type: String
    Default: main
  RepositoryName:
    Type: String

  BuildLogsRetentionDays:
    Type: Number
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
    Default: 14

Resources:
  BuildLogsGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub 'codebuild/blog/${RepositoryName}'
      RetentionInDays: !Ref BuildLogsRetentionDays
  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - !Sub 'codebuild.${AWS::URLSuffix}'
      Policies:
        - PolicyName: ContentAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: S3ObjectsAccess
                Action:
                  - s3:PutObject*
                  - s3:GetObject*
                Effect: Allow
                Resource:
                  - !Sub 'arn:${AWS::Partition}:s3:::${TmpBlogBucketName}/*'
                  - !Sub 'arn:${AWS::Partition}:s3:::${BlogBucketName}/*'
              - Sid: S3BucketAccess
                Action:
                  - s3:ListBucket
                Effect: Allow
                Resource:
                  - !Sub 'arn:${AWS::Partition}:s3:::${BlogBucketName}'
                  - !Sub 'arn:${AWS::Partition}:s3:::${TmpBlogBucketName}'
              - Sid: CloudFrontAccess
                Action:
                  cloudfront:CreateInvalidation
                Effect: Allow
                Resource:
                  !Sub 'arn:${AWS::Partition}:cloudfront::${AWS::AccountId}:distribution/${BlogDistributionId}'
              - Sid: CloudWatchLogs
                Effect: Allow
                Action:
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub '${BuildLogsGroup.Arn}'


  TmpBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      ServiceRole: !GetAtt 'CodeBuildRole.Arn'
      Description: !Sub 'Publishes blog on updates'
      LogsConfig:
        CloudWatchLogs:
          GroupName: !Ref BuildLogsGroup
          Status: ENABLED
          StreamName: prerelease
      BadgeEnabled: True
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:3.0
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: BLOG_BUCKET_NAME
            Type: PLAINTEXT
            Value: !Ref TmpBlogBucketName
          - Name: CLOUDFRONT_ID
            Type: PLAINTEXT
            Value: !Ref BlogDistributionId
      Source:
        Type: GITHUB
        ReportBuildStatus: True
        Location: !Sub "${CVSProviderUrl}${RepositoryName}"
        InsecureSsl: False
        BuildSpec: buildspec_pr.yml
      Triggers:
        Webhook: True
        FilterGroups:
          - - Type: EVENT
              Pattern: "PULL_REQUEST_CREATED, PULL_REQUEST_UPDATED, PULL_REQUEST_REOPENED"
              ExcludeMatchedPattern: False
            - Type: HEAD_REF
              Pattern: '^refs/heads/.*$'
              ExcludeMatchedPattern: False
            - Type: BASE_REF
              Pattern: !Sub '^refs/heads/${BranchName}$'
              ExcludeMatchedPattern: False

  PublishProject:
    Type: AWS::CodeBuild::Project
    Properties:
      ServiceRole: !GetAtt 'CodeBuildRole.Arn'
      Description: !Sub 'Publishes blog on updates'
      BadgeEnabled: True
      LogsConfig:
        CloudWatchLogs:
          GroupName: !Ref BuildLogsGroup
          Status: ENABLED
          StreamName: release
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:3.0
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: BLOG_BUCKET_NAME
            Type: PLAINTEXT
            Value: !Ref BlogBucketName
          - Name: CLOUDFRONT_ID
            Type: PLAINTEXT
            Value: !Ref BlogDistributionId
      Source:
        Type: GITHUB
        ReportBuildStatus: True
        Location: !Sub "${CVSProviderUrl}${RepositoryName}"
        InsecureSsl: False
      Triggers:
        Webhook: True
        FilterGroups:
          - - Type: EVENT
              Pattern: PUSH
              ExcludeMatchedPattern: False
            - Type: HEAD_REF
              Pattern: !Sub '^refs/heads/${BranchName}$'
              ExcludeMatchedPattern: False