template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  AWS CDK review & deploy tool working on Pull Request

Metadata:
  AWS::ServerlessRepo::Application:
    Name: cdkbot
    Description: AWS CDK review & deploy tool working on Pull Request
    Author: sambaiz
    SpdxLicenseId: Apache-2.0
    LicenseUrl: LICENSE
    ReadmeUrl: README.md
    Labels: ['cloudformation', 'cdk']
    HomePageUrl: https://github.com/sambaiz/cdkbot
    SemanticVersion: 0.5.0
    SourceCodeUrl: https://github.com/sambaiz/cdkbot

Parameters:
  Platform:
    Description: Only support github
    Type: String
    AllowedValues:
      - github
    Default: github
  GitHubUserName:
    Description: Name of the GitHub user calling the API
    Type: String
  GitHubAccessToken:
    Description: Access token of the GitHub user calling the API
    Type: String
    NoEcho: true
  GitHubWebhookSecret:
    Description: Repository's webhook secret
    Type: String
    NoEcho: true
  SubnetID:
    Description: Subnet ID to run ECS task
    Type: String

Globals:
  Function:
    Timeout: 600
    MemorySize: 1024

Resources:
  WebhookFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/webhook/
      Handler: webhook
      Runtime: go1.x
      Role: !GetAtt WebhookFunctionRole.Arn
      Timeout: 10
      MemorySize: 128
      Environment:
        Variables:
          TASK_ECS_CLUSTER_ARN: !GetAtt ECSCluster.Arn
          OPERATION_SERVICE_ARN: !Ref OperationService
          OPERATION_QUEUE_URL: !Ref OperationQueue
      Events:
        CatchAll:
          Type: Api
          Properties:
            Path: /webhook
            Method: POST
  WebhookFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lambda/${WebhookFunction}
      RetentionInDays: 14
  WebhookFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: cdkbot-webhook-function-role-policy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action: "ecs:UpdateService"
                Resource: !Sub 'arn:aws:ecs:${AWS::Region}:${AWS::AccountId}:service/${ECSCluster}/${OperationService.Name}'
              - Effect: "Allow"
                Action: "sqs:SendMessage"
                Resource: !GetAtt OperationQueue.Arn
  ECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: 'cdkbot'
  TaskExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Principal:
              Service: 'ecs-tasks.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: cdkbot-task-execution-role-policy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Action:
                  - ecr:GetAuthorizationToken
                  - ecr:BatchCheckLayerAvailability
                  - ecr:GetDownloadUrlForLayer
                  - ecr:BatchGetImage
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: '*'
  OperationTaskRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: 'Allow'
            Principal:
              Service: 'ecs-tasks.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        # Caution: cdkbot use a very strong role because cdk can modify whatever resources.
        - arn:aws:iam::aws:policy/AdministratorAccess
  OperationTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      RequiresCompatibilities:
        - 'FARGATE'
      NetworkMode: 'awsvpc'
      ExecutionRoleArn: !Ref TaskExecutionRole
      TaskRoleArn: !Ref OperationTaskRole
      Cpu: '512'
      Memory: '1024'
      ContainerDefinitions:
        - Name: 'cdkbot-operation'
          Image: 'sambaiz/cdkbot-operation:0.5.0'
          Essential: 'true'
          LogConfiguration:
            LogDriver: 'awslogs'
            Options:
              awslogs-group: !Ref OperationTaskLogGroup
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: 'cdkbot-operation'
          Environment:
            - Name: 'PLATFORM'
              Value: !Ref Platform
            - Name: 'GITHUB_USER_NAME'
              Value: !Ref GitHubUserName
            - Name: 'GITHUB_ACCESS_TOKEN'
              Value: !Ref GitHubAccessToken
            - Name: 'GITHUB_WEBHOOK_SECRET'
              Value: !Ref GitHubWebhookSecret
            - Name: 'TASK_ECS_CLUSTER_ARN'
              Value: !GetAtt ECSCluster.Arn
            - Name: 'OPERATION_SERVICE_ARN'
              # cannot ref due to circular dependency
              # Value: !Ref OperationService
              Value: !Sub 'arn:aws:ecs:${AWS::Region}:${AWS::AccountId}:service/operation'
            - Name: 'OPERATION_QUEUE_URL'
              Value: !Ref OperationQueue
  OperationTaskLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: cdkbot-operation
      RetentionInDays: 1
  OperationService:
    Type: AWS::ECS::Service
    Properties:
      Cluster: !GetAtt ECSCluster.Arn
      LaunchType: FARGATE
      DesiredCount: 0
      TaskDefinition: !Ref OperationTaskDefinition
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: 'ENABLED'
          Subnets:
            - !Ref SubnetID
      ServiceName: 'operation'
  OperationQueue:
    Type: AWS::SQS::Queue
    Properties:
      FifoQueue: true
      ContentBasedDeduplication: true
Outputs:
  WebhookEndpoint:
    Description: "Webhook endpoint"
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/webhook"