Skip to content

Commit 0fa6768

Browse files
josecorellajosecorella
committed
chore: add cfn templates (#227)
1 parent afb89dd commit 0fa6768

File tree

3 files changed

+314
-8
lines changed

3 files changed

+314
-8
lines changed

‎AwsEncryptionSDK/codebuild/release/release.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,11 @@ batch:
2222
image: aws/codebuild/standard:6.0
2323
depend-on:
2424
- sign
25-
- identifier: release_prod
26-
buildspec: aws-encryption-sdk-net/codebuild/release/release-prod.yml
27-
env:
28-
type: LINUX_CONTAINER
29-
image: aws/codebuild/standard:6.0
30-
depend-on:
31-
- verify
32-
- release_staging
25+
# - identifier: release_prod
26+
# buildspec: aws-encryption-sdk-net/codebuild/release/release-prod.yml
27+
# env:
28+
# type: LINUX_CONTAINER
29+
# image: aws/codebuild/standard:6.0
30+
# depend-on:
31+
# - verify
32+
# - release_staging

‎cfn/net/CA-Staging.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
AWSTemplateFormatVersion: 2010-09-09
4+
Description: "Template for CodeArtifact repositories. Creates Domain if CreateDomainFlag is True"
5+
Parameters:
6+
DomainName:
7+
Type: String
8+
Description: The name of the CodeArtifact Domain
9+
Default: crypto-tools-internal
10+
RepositoryName:
11+
Type: String
12+
Description: Base Name for the Repositories
13+
Default: esdk-net
14+
CreateDomainFlag:
15+
Type: String
16+
Description: Attempt to create Domain or not
17+
Default: False
18+
AllowedValues:
19+
- True
20+
- False
21+
22+
Conditions:
23+
CreateDomain: !Equals
24+
- !Ref CreateDomainFlag
25+
- True
26+
27+
Resources:
28+
Domain:
29+
Type: AWS::CodeArtifact::Domain
30+
Condition: CreateDomain
31+
Properties:
32+
DomainName: !Ref DomainName
33+
34+
StagingRepo:
35+
Type: AWS::CodeArtifact::Repository
36+
Properties:
37+
DomainName: !Ref DomainName
38+
RepositoryName: !Sub "${RepositoryName}-staging"
39+

‎cfn/net/CB-Release.yml‎

Lines changed: 267 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,267 @@
1+
AWSTemplateFormatVersion: 2010-09-09
2+
Description: >-
3+
Template to build a CodeBuild Project, assumes that GitHub credentials are
4+
already set up.
5+
Parameters:
6+
ProjectName:
7+
Type: String
8+
Description: The name of the CodeBuild Project
9+
Default: AWS-ESDK-DotNet
10+
ProjectDescription:
11+
Type: String
12+
Description: The description for the CodeBuild Project
13+
Default: CFN stack for managing CodeBuild projects for the AWS ESDK Dotnet
14+
SourceLocation:
15+
Type: String
16+
Description: The https GitHub URL for the project
17+
Default: "https://github.com/aws/private-aws-encryption-sdk-dafny-staging.git"
18+
NumberOfBuildsInBatch:
19+
Type: Number
20+
MaxValue: 100
21+
MinValue: 1
22+
Default: 16
23+
Description: The number of builds you expect to run in a batch
24+
Metadata:
25+
"AWS::CloudFormation::Interface":
26+
ParameterGroups:
27+
- Label:
28+
default: Crypto Tools CodeBuild Project Template
29+
Parameters:
30+
- ProjectName
31+
- ProjectDescription
32+
- SourceLocation
33+
Resources:
34+
CodeBuildProjectRelease:
35+
Type: "AWS::CodeBuild::Project"
36+
Properties:
37+
Name: !Sub "${ProjectName}-Release"
38+
Description: !Sub "CodeBuild project for ${ProjectName} to sign packages and release to Nuget."
39+
Source:
40+
Location: !Ref SourceLocation
41+
BuildSpec: AwsEncryptionSDK/codebuild/release/release.yml
42+
## https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-codebuild-project-source.html#cfn-codebuild-project-source-gitclonedepth
43+
## If this value is 0, greater than 25, or not provided then the full history is downloaded with each build project.
44+
GitCloneDepth: 0
45+
GitSubmodulesConfig:
46+
FetchSubmodules: true
47+
InsecureSsl: false
48+
ReportBuildStatus: false
49+
Type: GITHUB
50+
Artifacts:
51+
Type: NO_ARTIFACTS
52+
Cache:
53+
Type: NO_CACHE
54+
Environment:
55+
ComputeType: BUILD_GENERAL1_LARGE
56+
Image: "aws/codebuild/standard:5.0"
57+
ImagePullCredentialsType: CODEBUILD
58+
PrivilegedMode: false
59+
Type: LINUX_CONTAINER
60+
ServiceRole: !GetAtt CodeBuildServiceRoleRelease.Arn
61+
TimeoutInMinutes: 60
62+
QueuedTimeoutInMinutes: 480
63+
EncryptionKey: !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/aws/s3"
64+
BadgeEnabled: false
65+
BuildBatchConfig:
66+
ServiceRole: !GetAtt CodeBuildServiceRoleRelease.Arn
67+
Restrictions:
68+
MaximumBuildsAllowed: !Ref NumberOfBuildsInBatch
69+
ComputeTypesAllowed:
70+
- BUILD_GENERAL1_SMALL
71+
- BUILD_GENERAL1_MEDIUM
72+
- BUILD_GENERAL1_LARGE
73+
TimeoutInMins: 480
74+
LogsConfig:
75+
CloudWatchLogs:
76+
Status: ENABLED
77+
S3Logs:
78+
Status: DISABLED
79+
EncryptionDisabled: false
80+
81+
CodeBuildServiceRoleRelease:
82+
Type: "AWS::IAM::Role"
83+
Properties:
84+
Path: /service-role/
85+
RoleName: !Sub "codebuild-${ProjectName}-service-role-release"
86+
AssumeRolePolicyDocument: >-
87+
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"codebuild.amazonaws.com"},"Action":"sts:AssumeRole"}]}
88+
MaxSessionDuration: 3600
89+
ManagedPolicyArns:
90+
- !Ref CryptoToolsKMS
91+
- !Ref CodeBuildBatchPolicyRelease
92+
- !Ref CodeBuildBasePolicy
93+
- !Ref AssumeArtifactRolePolicy
94+
- !Ref EsdkNugetAPIKeyPolicy
95+
- !Ref CodeBuildCISTSAllow
96+
- "arn:aws:iam::aws:policy/AWSCodeArtifactAdminAccess"
97+
98+
CodeBuildCISTSAllow:
99+
Type: "AWS::IAM::ManagedPolicy"
100+
Properties:
101+
ManagedPolicyName: !Sub >-
102+
CodeBuildCISTSAllow-${ProjectName}
103+
Path: /service-role/
104+
PolicyDocument: !Sub |
105+
{
106+
"Version": "2012-10-17",
107+
"Statement": [
108+
{
109+
"Effect": "Allow",
110+
"Action": "sts:AssumeRole",
111+
"Resource": "arn:aws:iam::370957321024:role/GitHub-CI-MPL-Dafny-Role-us-west-2"
112+
}
113+
]
114+
}
115+
116+
AssumeArtifactRolePolicy:
117+
Type: "AWS::IAM::ManagedPolicy"
118+
Properties:
119+
ManagedPolicyName: !Sub >-
120+
AssumeArtifactRolePolicy-${ProjectName}
121+
Path: /service-role/
122+
PolicyDocument: !Sub |
123+
{
124+
"Version": "2012-10-17",
125+
"Statement": [
126+
{
127+
"Effect": "Allow",
128+
"Resource": [
129+
"arn:aws:iam::365847122878:role/EncryptionSDKNetV4CodeSigning-ArtifactAccessRole"
130+
],
131+
"Action": [
132+
"sts:AssumeRole"
133+
]
134+
}
135+
]
136+
}
137+
138+
EsdkNugetAPIKeyPolicy:
139+
Type: "AWS::IAM::ManagedPolicy"
140+
Properties:
141+
ManagedPolicyName: !Sub >-
142+
EsdkNugetAPIKeyPolicy-${ProjectName}
143+
Path: /service-role/
144+
PolicyDocument: !Sub |
145+
{
146+
"Version": "2012-10-17",
147+
"Statement": [
148+
{
149+
"Effect": "Allow",
150+
"Resource": [
151+
"arn:aws:iam::582595803497:role/aws-crypto-tools-build-role"
152+
],
153+
"Action": [
154+
"sts:AssumeRole"
155+
]
156+
},
157+
{
158+
"Effect": "Allow",
159+
"Resource": [
160+
"arn:aws:secretsmanager:us-west-2:582595803497:secret:production/build/aws-crypto-tools-nuget-api-key*"
161+
],
162+
"Action": [
163+
"secretsmanager:GetSecretValue"
164+
]
165+
}
166+
]
167+
}
168+
169+
CodeBuildBatchPolicyRelease:
170+
Type: "AWS::IAM::ManagedPolicy"
171+
Properties:
172+
ManagedPolicyName: !Sub "CodeBuildBuildBatchPolicyRelease-${ProjectName}-${AWS::Region}"
173+
Path: /service-role/
174+
PolicyDocument: !Sub |
175+
{
176+
"Version": "2012-10-17",
177+
"Statement": [
178+
{
179+
"Effect": "Allow",
180+
"Resource": [
181+
"arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${ProjectName}-Release"
182+
],
183+
"Action": [
184+
"codebuild:StartBuild",
185+
"codebuild:StopBuild",
186+
"codebuild:RetryBuild"
187+
]
188+
}
189+
]
190+
}
191+
192+
CodeBuildBasePolicy:
193+
Type: "AWS::IAM::ManagedPolicy"
194+
Properties:
195+
ManagedPolicyName: !Sub "CodeBuildBasePolicy-${ProjectName}-${AWS::Region}"
196+
Path: /service-role/
197+
PolicyDocument: !Sub |
198+
{
199+
"Version": "2012-10-17",
200+
"Statement": [
201+
{
202+
"Effect": "Allow",
203+
"Resource": [
204+
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}",
205+
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}:*",
206+
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}-Release",
207+
"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${ProjectName}-Release:*"
208+
],
209+
"Action": [
210+
"logs:CreateLogGroup",
211+
"logs:CreateLogStream",
212+
"logs:PutLogEvents"
213+
]
214+
},
215+
{
216+
"Effect": "Allow",
217+
"Resource": [
218+
"arn:aws:s3:::codepipeline-${AWS::Region}-*"
219+
],
220+
"Action": [
221+
"s3:PutObject",
222+
"s3:GetObject",
223+
"s3:GetObjectVersion",
224+
"s3:GetBucketAcl",
225+
"s3:GetBucketLocation"
226+
]
227+
},
228+
{
229+
"Effect": "Allow",
230+
"Action": [
231+
"codebuild:CreateReportGroup",
232+
"codebuild:CreateReport",
233+
"codebuild:UpdateReport",
234+
"codebuild:BatchPutTestCases",
235+
"codebuild:BatchPutCodeCoverages"
236+
],
237+
"Resource": [
238+
"arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:report-group/${ProjectName}-*"
239+
]
240+
}
241+
]
242+
}
243+
244+
CryptoToolsKMS:
245+
Type: "AWS::IAM::ManagedPolicy"
246+
Properties:
247+
ManagedPolicyName: !Sub >-
248+
CrypotToolsKMSPolicy-${ProjectName}-${AWS::Region}-codebuild-${ProjectName}-service-role
249+
Path: /service-role/
250+
PolicyDocument: !Sub |
251+
{
252+
"Version": "2012-10-17",
253+
"Statement": [
254+
{
255+
"Effect": "Allow",
256+
"Resource": [
257+
"arn:aws:kms:*:658956600833:key/*",
258+
"arn:aws:kms:*:658956600833:alias/*"
259+
],
260+
"Action": [
261+
"kms:Encrypt",
262+
"kms:Decrypt",
263+
"kms:GenerateDataKey"
264+
]
265+
}
266+
]
267+
}

0 commit comments

Comments
 (0)