CodePipeline-Terraform-CF.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: CI/CD Pipeline for the Terraform projects

Parameters:
  BuildImageName:
    Type: String
    Description: Docker image for application build
    Default: aws/codebuild/amazonlinux2-x86_64-standard:3.0

  PipelineBucket:
    Type: String
    Description: S3 Bucket to use with Pipeline

  InitialSubscriberEmail:
    Description: Initial email for the alerts
    Type: String
    Default: NONE

  GitHubRepo:
    Description: GitHub repo to watch as <Organization name>/<repository>
    Type: String

  GitHubBranch:
    Description: Branch which this pipeline will monitor
    Type: String
    Default: main

  CodeStarConnectionArn:
    Description: pre-configured CodeStar Connection to the GitHub Org and Repo
    Type: String

  Environment:
    Description: Environment label to use
    Type: String
    Default: dev

  InfracostApiKey:
    Description: API Key for Infracost
    Type: String

  AutoApproveDelaySeconds:
    Description: Delay to trigger the auto-approve logic (in seconds)
    Type: Number
    Default: 30

  AutoApproveDiffPercentThreshold:
    Description: Relative difference in % between current and projected cloud spend, above which the manual approval will be needed
    Type: Number
    Default: 10

  AutoApproveDiffAbsoluteThreshold:
    Description: Absolute difference (in $) between current and projected cloud spend, above which the manual approval will be needed
    Type: Number
    Default: 100

Conditions:
  ConditionSubscriptionEmailPresent:
    !Not [ !Equals [ !Ref InitialSubscriberEmail, "NONE" ] ]

Resources:
  PipelineNotificationsTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: !Sub ${AWS::StackName}-pipeline-notifications
      Subscription:
        - !If
          - ConditionSubscriptionEmailPresent
          - Endpoint: !Ref "InitialSubscriberEmail"
            Protocol: email
          - !Ref "AWS::NoValue"

  PipelineServiceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-pipeline-service-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service:
                - codepipeline.amazonaws.com
                - codebuild.amazonaws.com
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: CodeStarConnection
                Resource: !Ref CodeStarConnectionArn
                Effect: Allow
                Action:
                  - codestar-connections:UseConnection
              - Sid: CodeBuildPermissions
                Resource: "*"
                Effect: Allow
                Action:
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds
                  - sns:Publish
              - Sid: CloudWatchLogs
                Resource: "*"
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
              - Sid: AccessPipelineBucket
                Effect: Allow
                Action:
                  - s3:Get*
                  - s3:ListBucket
                Resource:
                  - !Sub arn:aws:s3:::${PipelineBucket}
              - Sid: AccessPipelineBucketObjects
                Effect: Allow
                Action:
                  - s3:PutObject*
                  - s3:GetObject*
                Resource:
                  - !Sub arn:aws:s3:::${PipelineBucket}/*

  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt PipelineServiceRole.Arn
      Name: !Sub ${AWS::StackName}
      ArtifactStores:
        - Region: !Ref AWS::Region
          ArtifactStore:
            Type: S3
            Location: !Sub ${PipelineBucket}
      Stages:
        - Name: Source
          Actions:
            - Name: GitHub
              RunOrder: 1
              ActionTypeId:
                Category: Source
                Provider: CodeStarSourceConnection
                Owner: AWS
                Version: "1"
              Namespace: GitHubSource
              OutputArtifacts:
                - Name: GitHubCode
              Configuration:
                ConnectionArn: !Ref CodeStarConnectionArn
                FullRepositoryId: !Ref GitHubRepo
                BranchName: !Ref GitHubBranch
                OutputArtifactFormat: CODE_ZIP
                DetectChanges: true

        - Name: CreatePlan
          Actions:
            - Name: terraform-plan
              RunOrder: 1
              Namespace: TfPlan
              InputArtifacts:
                - Name: GitHubCode
              OutputArtifacts:
                - Name: TerraformPlan
              ActionTypeId:
                Category: Build
                Provider: CodeBuild
                Owner: AWS
                Version: "1"
              Configuration:
                ProjectName: !Ref TerraformPlanProject
                EnvironmentVariables: !Sub |
                  [
                    {"name": "EXECUTION_ID",            "value": "#{codepipeline.PipelineExecutionId}"},
                    {"name": "BRANCH",                  "value": "#{GitHubSource.BranchName}"},
                    {"name": "REPO",                    "value": "#{GitHubSource.FullRepositoryName}"},
                    {"name": "COMMIT_ID",               "value": "#{GitHubSource.CommitId}"},
                    {"name": "BUCKET",                  "value": "${PipelineBucket}"},
                    {"name": "TF_VAR_env",              "value": "${Environment}"}
                  ]

        - Name: CheckCosts
          Actions:
            - Name: check-costs
              RunOrder: 1
              Namespace: CostsVariables
              InputArtifacts:
                - Name: GitHubCode
                - Name: TerraformPlan
              OutputArtifacts:
                - Name: CostsReport
              ActionTypeId:
                Category: Build
                Provider: CodeBuild
                Owner: AWS
                Version: "1"
              Configuration:
                ProjectName: !Ref CheckCostsProject
                PrimarySource: GitHubCode
                EnvironmentVariables: !Sub |
                  [
                    {"name": "EXECUTION_ID",      "value": "#{codepipeline.PipelineExecutionId}"},
                    {"name": "env",               "value": "${Environment}"},
                    {"name": "INFRACOST_API_KEY", "value": "${InfracostApiKey}"}
                  ]

        - Name: ReviewPlan
          Actions:
            - Name: review-plan
              RunOrder: 1
              ActionTypeId:
                Category: Approval
                Provider: Manual
                Owner: AWS
                Version: "1"
              Configuration:
                CustomData: "Please review the Terraform Plan. Costs: old $#{CostsVariables.PastTotalMonthlyCost}, new $#{CostsVariables.TotalMonthlyCost}, difference $#{CostsVariables.DiffTotalMonthlyCost}"

        - Name: ApplyPlan
          Actions:
            - Name: terraform-apply
              RunOrder: 1
              InputArtifacts:
                - Name: GitHubCode
                - Name: TerraformPlan
              ActionTypeId:
                Category: Build
                Provider: CodeBuild
                Owner: AWS
                Version: "1"
              Configuration:
                ProjectName: !Ref TerraformApplyProject
                PrimarySource: GitHubCode
                EnvironmentVariables: !Sub |
                  [
                    {"name": "EXECUTION_ID",            "value": "#{codepipeline.PipelineExecutionId}"},
                    {"name": "BRANCH",                  "value": "#{GitHubSource.BranchName}"},
                    {"name": "REPO",                    "value": "#{GitHubSource.FullRepositoryName}"},
                    {"name": "COMMIT_ID",               "value": "#{GitHubSource.CommitId}"},
                    {"name": "BUCKET",                  "value": "${PipelineBucket}"},
                    {"name": "TF_VAR_env",              "value": "${Environment}"}
                  ]

  ProjectServiceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-codebuild-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service:
                - codebuild.amazonaws.com
      # Used for Terraform, please restrict to minimal
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: CloudWatchLogs
                Resource: "*"
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
              - Sid: AccessPipelineBucket
                Effect: Allow
                Action:
                  - s3:ListBucket
                  - s3:GetBucketVersioning
                Resource:
                  - !Sub arn:aws:s3:::${PipelineBucket}
              - Sid: AccessPipelineBucketObjects
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:PutObjectAcl
                  - s3:GetObject
                  - s3:GetObjectVersion
                Resource:
                  - !Sub arn:aws:s3:::${PipelineBucket}/*
              - Sid: AccessApproveQueue
                Effect: Allow
                Action:
                  - sqs:SendMessage
                  - sqs:GetQueueUrl
                Resource:
                  - !GetAtt AutoApproveQueue.Arn

  TerraformPlanProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub ${AWS::StackName}-tf-plan
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: pipeline/buildspec-tf-plan.yaml
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Type: LINUX_CONTAINER
        Image: !Ref BuildImageName
      ServiceRole: !GetAtt ProjectServiceRole.Arn

  TerraformApplyProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub ${AWS::StackName}-tf-apply
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: pipeline/buildspec-tf-apply.yaml
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Type: LINUX_CONTAINER
        Image: !Ref BuildImageName
      ServiceRole: !GetAtt ProjectServiceRole.Arn

  CheckCostsProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub ${AWS::StackName}-check-costs
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: pipeline/buildspec-check-costs.yaml
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Type: LINUX_CONTAINER
        Image: !Ref BuildImageName
        EnvironmentVariables:
          - Name: SQS_QUEUE
            Value: !Sub ${AutoApproveQueue}
      ServiceRole: !GetAtt ProjectServiceRole.Arn

  AutoApproveQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub ${AWS::StackName}-autoapprove-queue
      DelaySeconds: !Ref AutoApproveDelaySeconds

  AutoApproveQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - Ref: AutoApproveQueue
      PolicyDocument:
        Id: AllowIncomingAccess
        Statement:
          - Action:
              - sqs:SendMessage
              - sqs:ReceiveMessage
            Effect: "Allow"
            Resource:
              - !GetAtt AutoApproveQueue.Arn
            Principal:
              AWS:
                - !Ref AWS::AccountId

  AutoApproveLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      FunctionName: !Sub ${AWS::StackName}-autoapprove-function
      Handler: index.lambda_handler
      MemorySize: 128
      Runtime: python3.11
      Role: !GetAtt LambdaFunctionRole.Arn
      Environment:
        Variables:
          SNSTopic: !Ref PipelineNotificationsTopic
          DiffAbsolute: !Ref AutoApproveDiffAbsoluteThreshold
          DiffPercent: !Ref AutoApproveDiffPercentThreshold
          PipelineName: !Sub ${AWS::StackName}
          Region: !Sub ${AWS::Region}
      Code:
        ZipFile: |
          # Imports
          import logging

          # Set up the logger
          logger = logging.getLogger()
          logger.setLevel(logging.INFO)
          #logger.setLevel(logging.DEBUG) # Very verbose

          def lambda_handler(event, context):
              logger.info("#EVENT")
              logger.info(event)

  LambdaFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: AppendToLogsPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: "*"
        - PolicyName: SQSQueueAccessPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - sqs:SendMessage
                  - sqs:ReceiveMessage
                  - sqs:ReceiveMessage
                  - sqs:DeleteMessage
                  - sqs:GetQueueAttributes
                Resource:
                  - !GetAtt AutoApproveQueue.Arn
        - PolicyName: PipelineAccessPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - codepipeline:EnableStageTransition
                  - codepipeline:GetPipeline
                  - codepipeline:GetPipelineState
                  - codepipeline:GetPipelineExecution
                  - codepipeline:ListPipelineExecutions
                  - codepipeline:ListActionExecutions
                  - codepipeline:ListActionTypes
                  - codepipeline:ListPipelines
                  - codepipeline:ListTagsForResource
                  - codepipeline:PutApprovalResult
                Resource:
                  - !Sub arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${Pipeline}
                  - !Sub arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${Pipeline}/*
        - PolicyName: SNSAccessPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - sns:Publish
                Resource:
                  - !Ref PipelineNotificationsTopic

  LambdaFunctionSqsEventSourceMapping:
    Type: AWS::Lambda::EventSourceMapping
    DependsOn:
      - LambdaFunctionRole
    Properties:
      BatchSize: 1
      Enabled: true
      EventSourceArn: !GetAtt AutoApproveQueue.Arn
      FunctionName: !GetAtt AutoApproveLambdaFunction.Arn