pipeline.yaml

Resources:
  ArtifactBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join
        - "-"
        - - "graviton2"
          - !Ref AWS::AccountId

  CodeCommitRepository:
    Type: AWS::CodeCommit::Repository
    Properties:
      RepositoryName: "graviton2-lambda"

  CodePipelineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "codepipeline.amazonaws.com"
                - "cloudformation.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess
      Path: "/"

  Application:
    Type: AWS::CodeDeploy::Application
    Properties:
      ApplicationName: "graviton2-lambda"
      ComputePlatform: Lambda

  Deployment:
    Type: AWS::CodeDeploy::DeploymentGroup
    Properties:
      AlarmConfiguration:
        Alarms:
          - Name: !Ref functionErrors
        Enabled: true
        IgnorePollAlarmFailure: false
      ApplicationName: !Ref Application
      AutoRollbackConfiguration:
        Enabled: true
        Events:
          - DEPLOYMENT_FAILURE
          - DEPLOYMENT_STOP_ON_ALARM
          - DEPLOYMENT_STOP_ON_REQUEST
      DeploymentConfigName: CodeDeployDefault.LambdaLinear10PercentEvery1Minute
      DeploymentStyle:
        DeploymentOption: WITH_TRAFFIC_CONTROL
        DeploymentType: BLUE_GREEN
      ServiceRoleArn: !GetAtt DeployRole.Arn

  DeployRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "codedeploy.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda
        - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
      Path: "/"

  CodePipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt CodePipelineRole.Arn
      Stages:
        - Name: Source
          Actions:
          - InputArtifacts: []
            OutputArtifacts:
              - Name: "graviton2-lambda"
            Name: source
            Configuration:
              RepositoryName: "graviton2-lambda"
              BranchName: main
              PollForSourceChanges: 'false'
            RunOrder: 1
            ActionTypeId:
              Version: '1'
              Provider: CodeCommit
              Category: Source
              Owner: AWS
        - Name: Deploy
          Actions:
          - Name: Deploy
            ActionTypeId:
              Category: Deploy
              Owner: AWS
              Provider: CloudFormation
              Version: '1'
            RunOrder: 1
            Configuration:
              ActionMode: REPLACE_ON_FAILURE
              Capabilities: CAPABILITY_IAM
              RoleArn: !GetAtt CodePipelineRole.Arn
              StackName: GravitonFunction
              TemplatePath: 'graviton2-lambda::template.yaml'
            OutputArtifacts: []
            InputArtifacts:
              - Name: "graviton2-lambda"
        - Name: Release
          Actions:
            -
              Name: Release
              InputArtifacts:
                - Name: "graviton2-lambda"
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: '1'
                Provider: CodeDeploy
              Configuration:
                ApplicationName: !Ref Application
                DeploymentGroupName: !Ref Deployment
              RunOrder: 1
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactBucket


  AmazonCloudWatchEventRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        -
          PolicyName: cwe-pipeline-execution
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action: codepipeline:StartPipelineExecution
                Resource: !Join
                  - ":"
                  - - "arn:aws:codepipeline"
                    - !Ref AWS::Region
                    - !Ref AWS::AccountId
                    - !Ref CodePipeline

  AmazonCloudWatchEventRule:
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        source:
          - aws.codecommit
        detail-type:
          - 'CodeCommit Repository State Change'
        resources:
          - !GetAtt CodeCommitRepository.Arn
        detail:
          event:
            - referenceCreated
            - referenceUpdated
          referenceType:
            - branch
          referenceName:
            - main
      Targets:
        -
          Arn: !Join
            - ":"
            - - "arn:aws:codepipeline"
              - !Ref AWS::Region
              - !Ref AWS::AccountId
              - !Ref CodePipeline
          RoleArn: !GetAtt AmazonCloudWatchEventRole.Arn
          Id: CodePipeline

  functionErrors:
    Type: AWS::CloudWatch::Alarm
    Properties:
      Namespace: AWS/Lambda
      MetricName: Errors
      Dimensions:
        - Name: FunctionName
          Value: graviton
      Statistic: Sum
      Period: 60
      EvaluationPeriods: 1
      Threshold: 0
      TreatMissingData: notBreaching
      ComparisonOperator: GreaterThanThreshold

Outputs:
  CodeCommitRemote:
    Value: !Join
      - ""
      - - "codecommit::"
        - !Ref AWS::Region
        - "://"
        - !GetAtt CodeCommitRepository.Name