pipeline.yml

AWSTemplateFormatVersion: "2010-09-09"

Description: "Selenium Test Pipeline"

Parameters:

  GitHubToken:
    Type: String
    Description: |
      The GitHub token for CodePipeline access to GitHub
    NoEcho: true

  Repository:
    Type: String
    AllowedPattern: "^[-_a-zA-Z0-9]+/[-_a-zA-Z0-9]+$"
    ConstraintDescription: |
      Ensure you have defined a full path, including the username or
      organisation name.
    Description: |
      The full name of the repository, such as "<username>/<name>".

  Branch:
    Type: String
    AllowedPattern: "^[-_a-zA-Z0-9]+$"
    ConstraintDescription: |
      Only alpha numeric characters, as well as "-" and "_" are allowed.
    Description: |
      Branch to use from the repository.

  SeleniumKeyPairName:
    Type: String
    Description: |
      Name of the EC2 Keypair for Selenium EC2 Instances

Resources:

  PipelineArtifactStore:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Status: Enabled
            ExpirationInDays: 1
      WebsiteConfiguration:
        IndexDocument: index.html
        RoutingRules:
          - RedirectRule:
              ReplaceKeyPrefixWith: reports/latest/
            RoutingRuleCondition:
              HttpErrorCodeReturnedEquals: 404

  PipelineArtifactStoreReportPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref PipelineArtifactStore
      PolicyDocument:
        Statement:
          - Action:
              - 's3:GetObject'
            Effect: Allow
            Principal: '*'
            Resource:
              - !Sub "${PipelineArtifactStore.Arn}/reports/*"

  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RestartExecutionOnUpdate: true
      ArtifactStore:
        Location: !Ref PipelineArtifactStore
        Type: S3
      RoleArn: !GetAtt PipelineRole.Arn
      Stages:
        - Name: Source
          Actions:
            - Name: GitHub
              RunOrder: 1
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: 1
                Provider: GitHub
              OutputArtifacts:
                - Name: GitHubOutput
              Configuration:
                Owner: !Select [ 0, !Split [ "/", !Ref Repository ] ]
                Repo: !Select [ 1, !Split [ "/", !Ref Repository ] ]
                Branch: !Ref Branch
                OAuthToken: !Ref GitHubToken
        - Name: Selenium
          Actions:
            - Name: Reset
              RunOrder: 1
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              Configuration:
                ActionMode: DELETE_ONLY
                RoleArn: !GetAtt CloudformationRole.Arn
                StackName: !Sub "${AWS::StackName}-selenium"
            - Name: Create
              RunOrder: 2
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              InputArtifacts:
                - Name: GitHubOutput
              OutputArtifacts:
                - Name: SeleniumOutput
              Configuration:
                ActionMode: REPLACE_ON_FAILURE
                Capabilities: CAPABILITY_IAM
                RoleArn: !GetAtt CloudformationRole.Arn
                StackName: !Sub "${AWS::StackName}-selenium"
                TemplatePath: GitHubOutput::selenium.yml
                OutputFileName: Outputs.json
                ParameterOverrides: !Sub |
                  {
                    "KeyName": "${SeleniumKeyPairName}"
                  }
            - Name: DNS
              RunOrder: 3
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              InputArtifacts:
                - Name: SeleniumOutput
                - Name: GitHubOutput
              Configuration:
                ActionMode: REPLACE_ON_FAILURE
                Capabilities: CAPABILITY_IAM
                RoleArn: !GetAtt CloudformationRole.Arn
                StackName: !Sub "${AWS::StackName}-selenium-parameter-dns"
                TemplatePath: GitHubOutput::parameter.yml
                ParameterOverrides: !Sub |
                  {
                    "Key": "/Temp/${AWS::StackName}/DNSName",
                    "Value": { "Fn::GetParam": ["SeleniumOutput", "Outputs.json", "DNSName"] }
                  }
        - Name: Test
          Actions:
            - Name: Test
              RunOrder: 1
              InputArtifacts:
                - Name: GitHubOutput
              ActionTypeId:
                Category: Test
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              Configuration:
                ProjectName: !Ref TestBuild
        - Name: Teardown
          Actions:
            - Name: DNS
              RunOrder: 1
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              Configuration:
                ActionMode: DELETE_ONLY
                RoleArn: !GetAtt CloudformationRole.Arn
                StackName: !Sub "${AWS::StackName}-selenium-parameter-dns"
            - Name: Selenium
              RunOrder: 2
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: 1
              Configuration:
                ActionMode: DELETE_ONLY
                RoleArn: !GetAtt CloudformationRole.Arn
                StackName: !Sub "${AWS::StackName}-selenium"

  TestBuild:
    Type: AWS::CodeBuild::Project
    Properties:
      TimeoutInMinutes: 5
      ServiceRole: !GetAtt BuildRole.Arn
      Cache:
        Location: !Sub "${PipelineArtifactStore}/Cache/TestBuild"
        Type: S3
      Source:
        Type: CODEPIPELINE
        BuildSpec: testspec.yml
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/nodejs:7.0.0
        EnvironmentVariables:
          - Name: REPORT_LOCATION
            Type: PLAINTEXT
            Value: !Sub "${PipelineArtifactStore}/reports"
          - Name: SELENIUM_REMOTE_HOST
            Type: PARAMETER_STORE
            Value: !Sub "/Temp/${AWS::StackName}/DNSName"
          - Name: TARGET_URL
            Type: PLAINTEXT
            Value: "https://google.com"
      Artifacts:
        Type: CODEPIPELINE

  TestBuildLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/codebuild/${TestBuild}"
      RetentionInDays: 1

  CloudformationRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: cloudformation.amazonaws.com
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: RestrictedCloudFormationAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - 'cloudformation:CreateChangeSet'
                Effect: Allow
                Resource:
                  - !Sub "arn:${AWS::Partition}:cloudformation:${AWS::Region}:aws:transform/Serverless-2016-10-31"
              - Action:
                  - 'cloudformation:ExecuteChangeSet'
                Effect: Allow
                Resource:
                  - '*'
                Condition:
                  StringLike:
                    cloudformation:ChangeSetName: !Sub "${AWS::StackName}-*"
              - Action:
                  - '*'
                Effect: Allow
                Resource:
                  - '*'
                Condition:
                  ForAllValues:StringLike:
                    cloudformation:TemplateURL: !Sub "https://s3.${AWS::URLSuffix}/${PipelineArtifactStore}/*"

  PipelineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: codepipeline.amazonaws.com
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: CodePipelineAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - 's3:*'
                Effect: Allow
                Resource:
                  - !Sub "arn:aws:s3:::${PipelineArtifactStore}"
                  - !Sub "arn:aws:s3:::${PipelineArtifactStore}/*"
              - Action:
                  - 'codebuild:*'
                Effect: Allow
                Resource:
                  - !Sub "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${TestBuild}"
              - Action:
                  - 'cloudformation:CreateStack'
                  - 'cloudformation:DescribeStacks'
                  - 'cloudformation:DeleteStack'
                  - 'cloudformation:UpdateStack'
                  - 'cloudformation:CreateChangeSet'
                  - 'cloudformation:ExecuteChangeSet'
                  - 'cloudformation:DeleteChangeSet'
                  - 'cloudformation:DescribeChangeSet'
                  - 'cloudformation:SetStackPolicy'
                Effect: Allow
                Resource:
                  - !Sub "arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}*/*"
              - Action:
                  - 'iam:PassRole'
                Effect: Allow
                Resource:
                  - !GetAtt CloudformationRole.Arn

  BuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: codebuild.amazonaws.com
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: CodeBuildPackageAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                  - 's3:*'
                Effect: Allow
                Resource:
                  - !GetAtt PipelineArtifactStore.Arn
                  - !Sub "${PipelineArtifactStore.Arn}/*"
              - Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                Effect: Allow
                Resource: '*'
              - Action:
                  - 'ssm:GetParameters'
                Effect: Allow
                Resource:
                  - !Sub "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/Temp/${AWS::StackName}/*"

Outputs:

  PipelineConsoleURL:
    Description: Pipeline URL
    Value: !Sub "https://console.aws.amazon.com/codepipeline/home?region=${AWS::Region}#/view/${Pipeline}"

  ReportsURL:
    Description: URL to view Test Reports
    Value: !Sub "${PipelineArtifactStore.WebsiteURL}/reports/latest"