serverless.yml

service: frigg

custom:
  webhookSecret: ${file(./utils/parameters.js):generateWebhookSecret}

provider:
  name: aws
  runtime: nodejs6.10
  stage: local
  profile: personal
  environment:
    LOG_LEVEL: { Fn::FindInMap: [ LogLevel, '${opt:stage, self:provider.stage}', level ] }

functions:

  ConfigureGitHubWebhook:
    handler: webhooks/setup/configure.github
    role: ConfigureRole
    environment:
      WEBHOOK_HANDLER_URL: { Fn::Join : [ '', [ 'https://', { 'Ref' : ApiGatewayRestApi }, '.execute-api.', { 'Ref' : 'AWS::Region' }, '.amazonaws.com/${opt:stage, self:provider.stage}/github' ] ] }
      GITHUB_WEBHOOK_SECRET: ${self:custom.webhookSecret}
      FRIGG_CONFIG_BUCKET: { Ref: FriggConfig }
      # TODO extract this into a list of orgs in a config
      # TODO include whitelist and blacklist for repositories within org
      GITHUB_ORGANIZATION: santaswap

  # TODO create a pipeline for frigg to update itself
  # DogFoodFrigg:
  #   handler: 
  #   role: 
  #   environment:

  ProcessGitHubWebhook:
    handler: webhooks/messages/process.github
    role: PublishRole
    events:
      - http:
          path: github
          method: post
          cors: true
    environment:
      UPSERT_PIPELINE_TOPIC: { Ref: 'SNSTopicUpsertpipeline${opt:stage, self:provider.stage}' }
      REMOVE_PIPELINE_TOPIC: { Ref: 'SNSTopicRemovepipeline${opt:stage, self:provider.stage}' }
      REMOVE_REPOSITORY_PIPELINES_TOPIC: { Ref: 'SNSTopicRemoverepositorypipelines${opt:stage, self:provider.stage}' }
      GITHUB_WEBHOOK_SECRET: ${self:custom.webhookSecret}

  UpsertPipeline:
    handler: pipelines/handler.upsert
    role: DeployRole
    events: [ sns: 'upsert-pipeline-${opt:stage, self:provider.stage}' ]
    environment:
      PIPELINE_ADDED_TOPIC: { Ref: 'SNSTopicPipelineadded${opt:stage, self:provider.stage}' }
      BUILD_ARTIFACT_BUCKET: { Ref: BuildArtifacts }
      BUILD_PROJECT_NAME: { Ref: CodeBuild }

  RemovePipeline:
    handler: pipelines/handler.removePipeline
    role: DeployRole
    events: [ sns: 'remove-pipeline-${opt:stage, self:provider.stage}' ]
    environment:
      ODIN_REMOVE_STACK_TOPIC: hello #${cf:odin-${opt:stage, self:provider.stage}.DeleteStackSNS}
      PIPELINE_REMOVED_TOPIC: { Ref: 'SNSTopicPipelineremoved${opt:stage, self:provider.stage}' }

  RemoveRepositoryPipelines:
    handler: pipelines/handler.removeRepository
    role: DeployRole
    events: [ sns: 'remove-repository-pipelines-${opt:stage, self:provider.stage}' ]
    environment:
      ODIN_REMOVE_STACK_TOPIC: hello #${cf:odin-${opt:stage, self:provider.stage}.DeleteStackSNS}
      PIPELINE_REMOVED_TOPIC: { Ref: 'SNSTopicPipelineremoved${opt:stage, self:provider.stage}' }

  SavePipelineStatus:
    handler: status/handler.pipelineAdded
    role: TableRole
    events: [ sns: 'pipeline-added-${opt:stage, self:provider.stage}' ]
    environment:
      PIPELINES_TABLE: { Ref: PipelinesTable }

  RemovePipelineStatus:
    handler: status/handler.pipelineRemoved
    role: TableRole
    events: [ sns: 'pipeline-removed-${opt:stage, self:provider.stage}' ]
    environment:
      PIPELINES_TABLE: { Ref: PipelinesTable }
      BUILDS_TABLE: { Ref: BuildsTable }

  SaveBuildStartedStatus:
    handler: status/handler.buildStarted
    role: TableRole
    events: [ sns: 'build-started-${opt:stage, self:provider.stage}' ]
    environment:
      BUILDS_TABLE: { Ref: BuildsTable }

  SaveBuildFinishedStatus:
    handler: status/handler.buildFinished
    role: TableRole
    events: [ sns: 'build-finished-${opt:stage, self:provider.stage}' ]
    environment:
      BUILDS_TABLE: { Ref: BuildsTable }

resources:
  Description: Automated service for managing CodePipelines for repos & branches inside a GitHub organization

  Mappings:
    LogLevel:
      test:
        level: debug
      local:
        level: debug
      dev:
        level: debug
      automation:
        level: debug
      production:
        level: info
  
  Resources:
    
    PipelinesTable:
      Type: AWS::DynamoDB::Table
      Properties:
        AttributeDefinitions:
          - AttributeName: owner/repository
            AttributeType: S
          - AttributeName: branch
            AttributeType: S
        KeySchema:
          - AttributeName: owner/repository
            KeyType: HASH
          - AttributeName: branch
            KeyType: RANGE
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1
    
    BuildsTable:
      Type: AWS::DynamoDB::Table
      Properties:
        AttributeDefinitions:
          - AttributeName: owner/repository/branch
            AttributeType: S
          - AttributeName: timestamp
            AttributeType: S
        KeySchema:
          - AttributeName: owner/repository/branch
            KeyType: HASH
          - AttributeName: timestamp
            KeyType: RANGE
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1

    ConfigureGitHubWebhookCustomResource:
      Type: Custom::ConfigureGitHubWebhook
      Version: 1.0
      # TODO figure out which of these is latest and only depend on it
      DependsOn: [ ProcessGitHubWebhookLambdaPermissionApiGateway ]
      Properties:
        ServiceToken: { Fn::GetAtt: [ ConfigureGitHubWebhookLambdaFunction, Arn ] }
        GITHUB_WEBHOOK_SECRET: ${self:custom.webhookSecret}

    FriggConfig:
      Type: AWS::S3::Bucket

    BuildArtifacts:
      Type: AWS::S3::Bucket
      Properties:
        VersioningConfiguration:
          Status: Enabled

    CodeBuild:
      Type: AWS::CodeBuild::Project
      Properties:
        Name: FriggPipelineDeployer-${opt:stage, self:provider.stage}
        Description: 'CodeBuild used by Frigg in the ${opt:stage, self:provider.stage} environment to deploy pipelines for other projects'
        Source:
          Type: S3
          Location: { Fn::Join : [ /, [ { 'Ref' : BuildArtifacts }, 'build.zip' ] ] }
        Environment:
          Image: aws/codebuild/eb-nodejs-6.10.0-amazonlinux-64:4.0.0
          Type: LINUX_CONTAINER
          ComputeType: BUILD_GENERAL1_SMALL
        Artifacts:
          Type: NO_ARTIFACTS
        ServiceRole: { Ref: CodeBuildRole }
        TimeoutInMinutes: 60

    CodeBuildRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Action: sts:AssumeRole
              Effect: Allow
              Principal:
                AWS: { Fn::Join : [ ':', [ 'arn:aws:iam:', { 'Ref' : AWS::AccountId }, 'root' ] ] }
            - Action: sts:AssumeRole
              Effect: Allow
              Principal:
                Service: codebuild.amazonaws.com
        Path: /
        Policies:
          - PolicyName: FriggPipelineDeployerRole
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action: '*'
                  Resource: '*'

    PublishRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service: [ lambda.amazonaws.com ]
              Action: sts:AssumeRole
        Policies:
          - PolicyName: FriggSNSAccess-${opt:stage, self:provider.stage}
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
              - Effect: Allow
                Action: sns:Publish
                Resource: { Fn::Join : [ ':', [ 'arn:aws:sns', { 'Ref' : AWS::Region }, { 'Ref' : AWS::AccountId }, '*' ] ] }
              - Effect: Allow
                Action: logs:*
                Resource: { Fn::Join : [ ':', [ 'arn:aws:logs', { 'Ref' : AWS::Region }, { 'Ref' : AWS::AccountId }, '*' ] ] }

    TableRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service: [ lambda.amazonaws.com ]
              Action: sts:AssumeRole
        Policies:
          - PolicyName: FriggDynamoAccess-${opt:stage, self:provider.stage}
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
              - Effect: Allow
                Action: dynamodb:*
                Resource: { Fn::Join : [ ':', [ 'arn:aws:dynamodb', { 'Ref' : AWS::Region }, { 'Ref' : AWS::AccountId }, '*' ] ] }
              - Effect: Allow
                Action: logs:*
                Resource: { Fn::Join : [ ':', [ 'arn:aws:logs', { 'Ref' : AWS::Region }, { 'Ref' : AWS::AccountId }, '*' ] ] }

    ConfigureRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service: [ lambda.amazonaws.com ]
              Action: sts:AssumeRole
        Policies:
          - PolicyName: FriggS3Access-${opt:stage, self:provider.stage}
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
              - Effect: Allow
                Action: s3:*
                Resource: { Fn::Join : [ ':', [ 'arn:aws:s3', '', '', '*' ] ] }
              - Effect: Allow
                Action: ssm:*
                Resource: { Fn::Join : [ ':', [ 'arn:aws:ssm', { 'Ref' : AWS::Region }, { 'Ref' : AWS::AccountId }, '*' ] ] }
              - Effect: Allow
                Action: logs:*
                Resource: { Fn::Join : [ ':', [ 'arn:aws:logs', { 'Ref' : AWS::Region }, { 'Ref' : AWS::AccountId }, '*' ] ] }

    DeployRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service: [ lambda.amazonaws.com ]
              Action: sts:AssumeRole
        Policies:
          - PolicyName: FriggDeployAccess-${opt:stage, self:provider.stage}
            PolicyDocument:
              Version: '2012-10-17'
              Statement: 
                - Effect: Allow
                  Action: '*'
                  Resource: '*'