infrastructure.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: Infrastructure for CloudFormation templates, e.g. pipeline and bucket 
Parameters:
  TemplateBucketName:
    Type: String
  GithubOauthToken:
    Type: String
  DeploymentStage:
    Type: String
    Default: prod

Resources:

  TemplateBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref TemplateBucketName
      AccessControl: PublicRead

  TemplateBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref TemplateBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: Allow
          Principal: "*"
          Action: s3:GetObject
          Resource: !Sub arn:aws:s3:::${TemplateBucket}/*

  ArtifactStoreBucket:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled
      AccessControl: BucketOwnerFullControl

  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt PipelineRole.Arn
      ArtifactStore:
        Location:
          Ref:
            ArtifactStoreBucket
        Type: S3
      Stages:
        - Name: Source
          Actions:
            - InputArtifacts: []
              Name: SourceAction
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: 1
                Provider: GitHub
              OutputArtifacts:
                - Name: SourceOutput
              Configuration:
                Owner: s0enke
                Repo: cloudformation-templates
                Branch: master
                OAuthToken:
                  Ref: GithubOauthToken
              RunOrder: 1        
        - Name: DeploySelf
          Actions:
          - Name: DeploySelfAction
            ActionTypeId:
              Category: Deploy
              Owner: AWS
              Provider: CloudFormation
              Version: 1
            InputArtifacts:
              - Name: SourceOutput
            RunOrder: 1
            Configuration:
              ActionMode: CREATE_UPDATE
              Capabilities: CAPABILITY_IAM
              RoleArn: !GetAtt DeploySelfActionRole.Arn
              StackName: !Ref AWS::StackName
              TemplatePath: 'SourceOutput::infrastructure.yml'
              ParameterOverrides: !Sub '{"TemplateBucketName": "${TemplateBucketName}", "GithubOauthToken": "${GithubOauthToken}", "DeploymentStage": "${DeploymentStage}"}'
        - Name: ValidateAndDeployTemplates
          Actions:
            - InputArtifacts:
                - Name: SourceOutput
              Name: ValidateAndDeployTemplatesAction
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              OutputArtifacts:
                - Name: ValidateAndDeployTemplatesOutput
              Configuration:
                ProjectName:
                  Ref: ValidateAndDeployTemplatesBuild
              RunOrder: 2
  PipelineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: Allow
          Principal:
            Service: codepipeline.amazonaws.com
          Action: sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess

  DeploySelfActionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: Allow
          Principal:
            Service: cloudformation.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess

  ValidateAndDeployTemplatesBuild:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/eb-python-2.6-amazonlinux-64:2.1.3
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: TEMPLATE_DEPLOYMENT_BUCKET
            Value: !Ref TemplateBucket
      Name: !Sub ValidateAndDeployTemplatesBuild-${DeploymentStage}
      ServiceRole: !Ref ValidateAndDeployTemplatesBuildRole
      Source:
        Type: CODEPIPELINE

  ValidateAndDeployTemplatesBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: Allow
          Principal:
            Service: codebuild.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess