pipeline_codedeploy_TF.json

{
  "Parameters": {
    "OutputArtifact": {
      "Type": "String",
      "Description": "Name of the OutputArtifact",
      "Default": "MyApp"
    },
    "OutputArtifactBuild": {
      "Type": "String",
      "Description": "Name of the OutputArtifactBuild",
      "Default": "MyAppBuild"
    },
    "PipelineName": {
      "Type": "String",
      "Description": "Name of the Pipeline",
      "Default": "LambdaPipeline"
    },
    "CodeBuildName": {
      "Type": "String",
      "Description": "Name of the CodeBuild project",
      "Default": "SMSLambdaBuilder"
    },
    "SourceS3Bucket": {
      "Type": "String",
      "Description": "Name of the SourceS3Bucket where the model zip file is contained and the LambdaCopyModel is",
      "Default": "mltestdiego"
    },
    "SourceS3ObjectKey": {
      "Type": "String",
      "Description": "Name of the model zip file to monitor",
      "Default": "model.tar.gz"
    },
    "CodeBuildZip": {
      "Type": "String",
      "Description": "Name of the fake zip file",
      "Default": "test.zip"
    },
    "LambdaStackName": {
      "Type": "String",
      "Description": "Name of the Lambda stack",
      "Default": "AntiSpamAPI"
    }
  },




  "Resources": {




    "S3BucketCloudTrail": {
      "DeletionPolicy": "Retain",
      "Type": "AWS::S3::Bucket",
      "Properties": {}
    },
    "BucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {
          "Ref": "S3BucketCloudTrail"
        },
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [{
              "Sid": "AWSCloudTrailAclCheck",
              "Effect": "Allow",
              "Principal": {
                "Service": "cloudtrail.amazonaws.com"
              },
              "Action": "s3:GetBucketAcl",
              "Resource": {
                "Fn::Join": ["", ["arn:aws:s3:::", {
                  "Ref": "S3BucketCloudTrail"
                }]]
              }
            },
            {
              "Sid": "AWSCloudTrailWrite",
              "Effect": "Allow",
              "Principal": {
                "Service": "cloudtrail.amazonaws.com"
              },
              "Action": "s3:PutObject", 
              "Resource": {
                "Fn::Join": ["", ["arn:aws:s3:::", {
                  "Ref": "S3BucketCloudTrail"
                }, "/AWSLogs/", {
                  "Ref": "AWS::AccountId"
                }, "/*"]]
              },
              "Condition": {
                "StringEquals": {
                  "s3:x-amz-acl": "bucket-owner-full-control"
                }
              }
            }
          ]
        }
      }
    },

    "myTrail": {
      "DependsOn": ["BucketPolicy"],
      "Type": "AWS::CloudTrail::Trail",
      "Properties": {
        "S3BucketName": {
          "Ref": "S3BucketCloudTrail"
        },
        "EventSelectors": [{
          "IncludeManagementEvents": true,
          "DataResources": [{
            "Values": [{
              "Fn::Join": ["", ["arn:aws:s3:::", {
                "Ref": "SourceS3Bucket"
              }, "/", {
                "Ref": "SourceS3ObjectKey"
              }]]
            }],
            "Type": "AWS::S3::Object"
          },
          {
            "Values": [{
              "Fn::Join": ["", ["arn:aws:s3:::", {
                "Ref": "ModelS3Location"
              }, "/"]]
            }],
            "Type": "AWS::S3::Object"
          }
        ],
          "ReadWriteType": "WriteOnly"
        }],
        "IsLogging": true
      }
    },


    "SMSCWEvent": {
      "Type": "AWS::Events::Rule",
      "Properties": {
        "Description": "Amazon CloudWatch Events rule to automatically start your pipeline when a change occurs in the AWS CodeCommit source repository and branch.",
        "EventPattern": { "Fn::Sub": [  "{\"source\":[\"aws.s3\"],\"detail-type\":[\"AWS API Call via CloudTrail\"],\"detail\":{\"eventSource\":[\"s3.amazonaws.com\"],\"eventName\":[\"PutObject\", \"CopyObject\" ],\"resources\":{\"ARN\":[\"arn:aws:s3:::${SourceS3Bucket}/${SourceS3ObjectKey}\"]}}}", { "SourceS3Bucket": {"Ref" : "SourceS3Bucket" }, "SourceS3ObjectKey": {"Ref": "SourceS3ObjectKey"}} ]},
        "Targets": [{
          "Arn": {
            "Fn::Join": ["", ["arn:aws:codepipeline:", {
              "Ref": "AWS::Region"
            }, ":", {
              "Ref": "AWS::AccountId"
            }, ":", {
              "Ref": "LambdaPipeline"
            }]]
          },
          "Id": "LambdaPipeline",
          "RoleArn": {
            "Fn::GetAtt": ["CwIamRole", "Arn"]
          }
        }],
        "State": "ENABLED"
      }

    },



    "LambdaCopyModelIAM": {
        "Type": "AWS::IAM::Role",
        "Properties": {
          "AssumeRolePolicyDocument": {
               "Version" : "2012-10-17",
               "Statement": [ {
                  "Effect": "Allow",
                  "Principal": {
                     "Service": [ "lambda.amazonaws.com" ]
                  },
                  "Action": [ "sts:AssumeRole" ]
               } ]
            },          
          "ManagedPolicyArns": [ "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ],
          "Policies": [ 
          {
            "PolicyName": "Lambda-Copy-Model-IAM-Copy-S3",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [{
                "Effect": "Allow",
                "Action": [
                  "s3:*"
                ],
                "Resource": [
                  "*"
                ]
              }]

            }
          }
           ],
          "RoleName": "LambdaCopyModelIAM"
        }
      },


    "LambdaCopyModel": {
        "Type" : "AWS::Lambda::Function",
        "Properties" : {
          "Code": {
            "S3Bucket": {"Ref": "SourceS3Bucket"},
            "S3Key": "lambdaCopyModel.zip"
          },
          "Description" : "It gets a model and move it to the pipeline bucket",
          "Environment" : {
            "Variables": { "DESTINATION_BUCKET":"mltestdiego", "FILE_MODEL_NAME":"model.tar.gz", "SOURCE_BUCKET":"tests3fgh-models3location-1psvxz9i64l1t" }
          },
          "Handler" : "lambdaCopyModel.lambda_handler",
          "MemorySize" : 128,
          "Role" : {
           "Fn::GetAtt": [
              "LambdaCopyModelIAM",
              "Arn"
            ]},
          "Runtime" : "python2.7",
          "Timeout" : 2
        }
      },








      "LambdaInvokePermission": {
        "Type": "AWS::Lambda::Permission",
        "Properties": {
          "Action": "lambda:InvokeFunction",
          "Principal": "events.amazonaws.com",
          "FunctionName": {
            "Fn::GetAtt": [
              "LambdaCopyModel",
              "Arn"
            ]
          },
          "SourceArn": {
            "Fn::GetAtt": [
              "SMSModelCWEvent",
              "Arn"
            ]
          }
        }
      },





























    "SMSModelCWEvent": {
      "Type": "AWS::Events::Rule",
      "Properties": {
        "Description": "Amazon CloudWatch Events rule to automatically start your pipeline when a change occurs in the AWS CodeCommit source repository and branch.",
        "EventPattern": { "Fn::Sub": [  "{\"source\":[\"aws.s3\"],\"detail-type\":[\"AWS API Call via CloudTrail\"],\"detail\":{\"eventSource\":[\"s3.amazonaws.com\"],\"eventName\":[\"PutObject\", \"CopyObject\" ],\"requestParameters\":{\"bucketName\":[\"${SourceS3Bucket}\"]}}}", { "SourceS3Bucket": {"Ref" : "ModelS3Location" }} ]},
        "Targets": [{
          "Arn": { "Fn::GetAtt": [
              "LambdaCopyModel",
              "Arn"
            ]},
          "Id": "LambdaPipeline"      
        }
      ],
        "State": "ENABLED"
      }

    },

    "ModelS3Location": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "VersioningConfiguration": {
          "Status": "Enabled"
        }
      }
    },





    "ArtifactStoreS3Location": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "VersioningConfiguration": {
          "Status": "Enabled"
        }
      }
    },




    "CwIamRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [{
            "Effect": "Allow",
            "Principal": {
              "Service": ["events.amazonaws.com"]
            },
            "Action": ["sts:AssumeRole"]
          }]
        },
        "Path": "/",
        "Policies": [{
          "PolicyName": "CW-SMS-Antispam-CodeBuild-Policy-CodePipeline",
          "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [{
              "Effect": "Allow",
              "Action": [
                "codepipeline:StartPipelineExecution"
              ],
              "Resource": [
                "*"
              ]
            }]

          }
        },
{
          "PolicyName": "CW-SMS-Antispam-CodeBuild-Policy-Lambda",
          "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [{
              "Effect": "Allow",
              "Action": [
                "lambda:InvokeFunction"
              ],
              "Resource": [
                "*"
              ]
            }]

          }
        }


      ]
      }
    },








    "SMSCodeBuildRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [{
            "Effect": "Allow",
            "Principal": {
              "Service": ["codebuild.amazonaws.com"]
            },
            "Action": ["sts:AssumeRole"]
          }]
        },
        "Path": "/",
        "Policies": [{
          "PolicyName": "SMS-Antispam-CodeBuild-Policy",
          "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [{
                "Effect": "Allow",
                "Resource": "*",
                "Action": [
                  "logs:CreateLogGroup",
                  "logs:CreateLogStream",
                  "logs:PutLogEvents"
                ]
              },
              {
                "Effect": "Allow",
                "Resource": "*",
                "Action": [
                  "s3:PutObject",
                  "s3:GetObject",
                  "s3:GetObjectVersion"
                ]
              }

            ]
          }
        }]
      }
    },






    "SMSCodePipelineRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [{
            "Effect": "Allow",
            "Principal": {
              "Service": ["codepipeline.amazonaws.com"]
            },
            "Action": ["sts:AssumeRole"]
          }]
        },
        "Path": "/",
        "Policies": [{
          "PolicyName": "SMS-Antispam-CodePipeline-Policy",
          "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [{
                "Action": [
                  "s3:GetObject",
                  "s3:GetObjectVersion",
                  "s3:GetBucketVersioning"
                ],
                "Resource": "*",
                "Effect": "Allow"
              },
              {
                "Action": [
                  "s3:PutObject"
                ],
                "Resource": [
                  "arn:aws:s3:::codepipeline*",
                  "arn:aws:s3:::elasticbeanstalk*"
                ],
                "Effect": "Allow"
              },
              {
                "Action": [
                  "codecommit:CancelUploadArchive",
                  "codecommit:GetBranch",
                  "codecommit:GetCommit",
                  "codecommit:GetUploadArchiveStatus",
                  "codecommit:UploadArchive"
                ],
                "Resource": "*",
                "Effect": "Allow"
              },
              {
                "Action": [
                  "codedeploy:CreateDeployment",
                  "codedeploy:GetApplicationRevision",
                  "codedeploy:GetDeployment",
                  "codedeploy:GetDeploymentConfig",
                  "codedeploy:RegisterApplicationRevision"
                ],
                "Resource": "*",
                "Effect": "Allow"
              },
              {
                "Action": [
                  "elasticbeanstalk:*",
                  "ec2:*",
                  "elasticloadbalancing:*",
                  "autoscaling:*",
                  "cloudwatch:*",
                  "s3:*",
                  "sns:*",
                  "cloudformation:*",
                  "rds:*",
                  "sqs:*",
                  "ecs:*",
                  "iam:PassRole"
                ],
                "Resource": "*",
                "Effect": "Allow"
              },
              {
                "Action": [
                  "lambda:InvokeFunction",
                  "lambda:ListFunctions"
                ],
                "Resource": "*",
                "Effect": "Allow"
              },
              {
                "Action": [
                  "opsworks:CreateDeployment",
                  "opsworks:DescribeApps",
                  "opsworks:DescribeCommands",
                  "opsworks:DescribeDeployments",
                  "opsworks:DescribeInstances",
                  "opsworks:DescribeStacks",
                  "opsworks:UpdateApp",
                  "opsworks:UpdateStack"
                ],
                "Resource": "*",
                "Effect": "Allow"
              },
              {
                "Action": [
                  "cloudformation:CreateStack",
                  "cloudformation:DeleteStack",
                  "cloudformation:DescribeStacks",
                  "cloudformation:UpdateStack",
                  "cloudformation:CreateChangeSet",
                  "cloudformation:DeleteChangeSet",
                  "cloudformation:DescribeChangeSet",
                  "cloudformation:ExecuteChangeSet",
                  "cloudformation:SetStackPolicy",
                  "cloudformation:ValidateTemplate",
                  "iam:PassRole"
                ],
                "Resource": "*",
                "Effect": "Allow"
              },
              {
                "Action": [
                  "codebuild:BatchGetBuilds",
                  "codebuild:StartBuild"
                ],
                "Resource": "*",
                "Effect": "Allow"
              }
            ]
          }
        }]
      }
    },

    "CodeBuildProject": {
      "Type": "AWS::CodeBuild::Project",
      "Properties": {
        "TimeoutInMinutes": 10,
        "Name": {
          "Ref": "CodeBuildName"
        },
        "ServiceRole": {
          "Fn::GetAtt": ["SMSCodeBuildRole", "Arn"]
        },
        "Tags": [],
        "Artifacts": {
          "NamespaceType": "NONE",
          "Packaging": "NONE",
          "Type": "CODEPIPELINE",
          "Name": {
            "Ref": "CodeBuildName"
          }
        },
        "Cache": {
          "Type": "NO_CACHE"
        },
        "Environment": {
          "ComputeType": "BUILD_GENERAL1_SMALL",
          "PrivilegedMode": false,
          "Image": "aws/codebuild/ubuntu-base:14.04",
          "Type": "LINUX_CONTAINER",
          "EnvironmentVariables": []
        },
        "Source": {
          "BuildSpec": {
            "Fn::Sub": ["version: 0.2\n\nphases:\n  build:\n    commands:\n      - \"git clone https://github.com/sunilmallya/keras-lambda.git\"\n      - \"cd keras-lambda/src/\"\n      - \"ls -al\"\n      - \"aws s3 cp s3://${SourceBucket}/${SourceS3ObjectKey} .\"\n      - \"tar zxf ${SourceS3ObjectKey}\"\n      - \"cd export/Servo/*/\"\n      - \"cp -r * ../../../\"\n      - \"ls -al\"\n      - \"cd ../../../\"\n      - \"ls -al\"\n      - \"pwd\"\n      - \"rm -f ${SourceS3ObjectKey}\"\n      - \"rm -f lambdaTF.py*\"\n      - \"wget https://raw.githubusercontent.com/diegonat/smsantispam/master/lambdaTF.py\"\n      - \"mv lambdaTF.py lambda.py\"\n      - \"wget https://raw.githubusercontent.com/diegonat/smsantispam/master/lambdachecker.js\"\n      - \"rm -f samTemplateCodeDeployTF.yaml*\"\n      - \"wget https://raw.githubusercontent.com/diegonat/smsantispam/master/samTemplateCodeDeployTF.yaml\"\n      - \"aws cloudformation package --template-file samTemplateCodeDeployTF.yaml --s3-bucket ${SourceBucket} --output-template-file ../../outputSamTemplate.yaml\"\n      - \"cp samTemplateCodeDeployTF.yaml ../../\"\n\nartifacts:\n  type: zip\n  files:\n    - outputSamTemplate.yaml\n    - samTemplateCodeDeployTF.yaml", {
              "SourceBucket": {
                "Ref": "SourceS3Bucket"
              },
              "SourceS3ObjectKey": {
                "Ref": "SourceS3ObjectKey"
              }
            }]
          },
          "InsecureSsl": false,
          "Type": "CODEPIPELINE"
        },
        "BadgeEnabled": false,
        "Description": "Create Lambda deploying package"
      }

    },

    "LambdaPipeline": {
      "Type": "AWS::CodePipeline::Pipeline",
      "Properties": {
        "RoleArn": {
          "Fn::GetAtt": ["SMSCodePipelineRole", "Arn"]
        },
        "Stages": [{
            "Name": "Source",
            "Actions": [{
              "InputArtifacts": [],
              "Name": "Source",
              "ActionTypeId": {
                "Category": "Source",
                "Owner": "AWS",
                "Version": "1",
                "Provider": "S3"
              },
              "OutputArtifacts": [{
                "Name": {
                  "Ref": "OutputArtifact"
                }
              }],
              "Configuration": {
                "S3Bucket": {
                  "Ref": "SourceS3Bucket"
                },
                "PollForSourceChanges": "false",
                "S3ObjectKey": {
                  "Ref": "CodeBuildZip"
                }
              },
              "RunOrder": 1
            }]
          },
          {
            "Name": "Build",
            "Actions": [{
              "InputArtifacts": [{
                "Name": {
                  "Ref": "OutputArtifact"
                }
              }],
              "Name": "CodeBuild",
              "ActionTypeId": {
                "Category": "Build",
                "Owner": "AWS",
                "Version": "1",
                "Provider": "CodeBuild"
              },
              "OutputArtifacts": [{
                "Name": {
                  "Ref": "OutputArtifactBuild"
                }
              }],
              "Configuration": {
                "ProjectName": {
                  "Ref": "CodeBuildName"
                }
              },
              "RunOrder": 1
            }]
          },
          {
            "Name": "ExecuteChangeSet",
            "Actions": [{
              "InputArtifacts": [{
                "Name": {
                  "Ref": "OutputArtifactBuild"
                }
              }],
              "Name": "SMSspam",
              "ActionTypeId": {
                "Category": "Deploy",
                "Owner": "AWS",
                "Version": "1",
                "Provider": "CloudFormation"
              },
              "OutputArtifacts": [],
              "Configuration": {
                "ActionMode": "CHANGE_SET_REPLACE",
                "ChangeSetName": "SMSspam",
                "RoleArn": "arn:aws:iam::459905850578:role/Cloudformation-IAM",
                "Capabilities": "CAPABILITY_IAM",
                "StackName": {
                  "Ref": "LambdaStackName"
                },
                "TemplatePath": {
                  "Fn::Sub": ["${Artifact}::outputSamTemplate.yaml", {
                    "Artifact": {
                      "Ref": "OutputArtifactBuild"
                    }
                  }]
                }
              },
              "RunOrder": 1
            }]
          },
          {
            "Name": "ExecuteCF",
            "Actions": [{
              "InputArtifacts": [],
              "Name": "Execute",
              "ActionTypeId": {
                "Category": "Deploy",
                "Owner": "AWS",
                "Version": "1",
                "Provider": "CloudFormation"
              },
              "OutputArtifacts": [],
              "Configuration": {
                "StackName": {
                  "Ref": "LambdaStackName"
                },
                "ActionMode": "CHANGE_SET_EXECUTE",
                "ChangeSetName": "SMSspam"
              },
              "RunOrder": 1
            }]
          }
        ],
        "ArtifactStore": {
          "Type": "S3",
          "Location": {
            "Ref": "ArtifactStoreS3Location"
          }
        },
        "Name": {
          "Ref": "PipelineName"
        }
      }
    }
  }

}