templates/dotnet-containerbuild.yaml [75:214]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                              Effect: Allow
                        PolicyName: s3-instance-bucket-policy
                    Path: /
                    ManagedPolicyArns:
                    - !Sub 'arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore'
                    - !Sub 'arn:${AWS::Partition}:iam::aws:policy/CloudWatchAgentServerPolicy'
                    - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess"
                    - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonS3FullAccess"
                    AssumeRolePolicyDocument:
                      Version: "2012-10-17"
                      Statement:
                      - Effect: "Allow"
                        Principal:
                          Service:
                          - "ec2.amazonaws.com"
                          - "ssm.amazonaws.com"
                        Action: "sts:AssumeRole"
                IamInstanceProfile:
                  Type: "AWS::IAM::InstanceProfile"
                  Properties:
                    Roles:
                    - !Ref DockerCreateRole
                EC2Instance:
                  Type: "AWS::EC2::Instance"
                  Properties:
                    ImageId: !Ref LatestAmiId
                    InstanceType: "t3.2xlarge"
                    BlockDeviceMappings: 
                      - 
                        DeviceName: "/dev/sda1"
                        Ebs: 
                         VolumeSize: "50"
                    IamInstanceProfile: !Ref IamInstanceProfile
                    Tags:
                    - Key: "Name"
                      Value: "DotNetFrameworkContainer"
        - name: "getInstanceId"
          action: aws:executeAwsApi
          onFailure: "step:signalfailure"
          inputs:
            Service: ec2
            Api: DescribeInstances
            Filters:  
            - Name: "tag:Name"
              Values: [ "DotNetFrameworkContainer" ]
            - Name: "instance-state-name"
              Values: [ "running" ]
          outputs:
          - Name: InstanceId
            Selector: "$.Reservations..Instances..InstanceId"
            Type: "StringList"
        - name: "CreateDockerImage"
          action: "aws:runCommand"
          onFailure: "step:signalfailure"
          inputs:
            DocumentName: "AWS-RunRemoteScript"
            InstanceIds:
            - "{{getInstanceId.InstanceId}}"
            CloudWatchOutputConfig:
              CloudWatchOutputEnabled: "true"
            Parameters:
              sourceType: "S3"
              sourceInfo:
                !Sub
                  - '{"path": "https://${S3Bucket}.s3.${S3Region}.amazonaws.com/{{QSS3KeyPrefix}}scripts/Dockerfile"}'
                  - S3Bucket: !If 
                      - UsingDefaultBucket
                      - !Sub '${QSS3BucketName}-${AWS::Region}'
                      - !Ref QSS3BucketName
                    S3Region: !If 
                      - UsingDefaultBucket
                      - !Ref AWS::Region
                      - !Ref QSS3BucketRegion
              commandLine: "docker build -t {{ECRRepoName}}:latest -m 2GB ."
        - name: "PushDockerImagetoECR"
          action: aws:runCommand
          onFailure: "step:signalfailure"
          inputs:
            DocumentName: AWS-RunPowerShellScript
            InstanceIds: 
              - "{{getInstanceId.InstanceId}}"
            CloudWatchOutputConfig:
              CloudWatchOutputEnabled: "true"
            Parameters:
              commands: 
                - |     
                   $Region = (Invoke-RestMethod -Method Get -Uri http://169.254.169.254/latest/dynamic/instance-identity/document).region
                   $AccountID = (Invoke-RestMethod -Method Get -Uri http://169.254.169.254/latest/dynamic/instance-identity/document).accountId
        
                   $ecrurl = $AccountID + '.dkr.ecr.' + $Region + '.amazonaws.com/{{ECRRepoName}}:latest'
        
                   Invoke-Expression -Command (Get-ECRLoginCommand -Region $Region).Command
                   docker tag {{ECRRepoName}}:latest $ecrurl
                   docker push $ecrurl
        # Determines if CFN Needs to be Signaled or if Work flow should just end
        - name: CFNSignalEnd
          action: aws:branch
          inputs:
            Choices:
            - NextStep: signalsuccess
              Not: 
                Variable: "{{StackName}}"
                StringEquals: ""
            - NextStep: sleepend
              Variable: "{{StackName}}"
              StringEquals: ""
        # If all steps complete successfully signals CFN of Success
        - name: "signalsuccess"
          action: "aws:executeAwsApi"
          nextStep: "deleteStack"
          inputs:
            Service: cloudformation
            Api: SignalResource
            LogicalResourceId: "SSMWaitCondition"
            StackName: "{{StackName}}"
            Status: SUCCESS
            UniqueId: "SSMWaitCondition"
        # If CFN Signl Not Needed this sleep ends work flow
        - name: "sleepend"
          action: "aws:sleep"
          nextStep: "deleteStack"
          inputs:
            Duration: PT1S
        # If any steps fails signals CFN of Failure
        - name: "signalfailure"
          action: "aws:executeAwsApi"
          nextStep: "deleteStack"
          inputs:
            Service: cloudformation
            Api: SignalResource
            LogicalResourceId: "SSMWaitCondition"
            StackName: "{{StackName}}"
            Status: FAILURE
            UniqueId: "SSMWaitCondition"
        - name: deleteStack
          action: aws:deleteStack
          isEnd: true
          onFailure: Continue
          inputs:
            StackName: !Sub "DotNetContainer-${AWS::StackName}"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/quickstart-dotnet-serverless-cicd.yml [500:639]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                              Effect: Allow
                        PolicyName: s3-instance-bucket-policy
                    Path: /
                    ManagedPolicyArns:
                    - !Sub 'arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore'
                    - !Sub 'arn:${AWS::Partition}:iam::aws:policy/CloudWatchAgentServerPolicy'
                    - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess"
                    - !Sub "arn:${AWS::Partition}:iam::aws:policy/AmazonS3FullAccess"
                    AssumeRolePolicyDocument:
                      Version: "2012-10-17"
                      Statement:
                      - Effect: "Allow"
                        Principal:
                          Service:
                          - "ec2.amazonaws.com"
                          - "ssm.amazonaws.com"
                        Action: "sts:AssumeRole"
                IamInstanceProfile:
                  Type: "AWS::IAM::InstanceProfile"
                  Properties:
                    Roles:
                    - !Ref DockerCreateRole
                EC2Instance:
                  Type: "AWS::EC2::Instance"
                  Properties:
                    ImageId: !Ref LatestAmiId
                    InstanceType: "t3.2xlarge"
                    BlockDeviceMappings: 
                      - 
                        DeviceName: "/dev/sda1"
                        Ebs: 
                         VolumeSize: "50"
                    IamInstanceProfile: !Ref IamInstanceProfile
                    Tags:
                    - Key: "Name"
                      Value: "DotNetFrameworkContainer"
        - name: "getInstanceId"
          action: aws:executeAwsApi
          onFailure: "step:signalfailure"
          inputs:
            Service: ec2
            Api: DescribeInstances
            Filters:  
            - Name: "tag:Name"
              Values: [ "DotNetFrameworkContainer" ]
            - Name: "instance-state-name"
              Values: [ "running" ]
          outputs:
          - Name: InstanceId
            Selector: "$.Reservations..Instances..InstanceId"
            Type: "StringList"
        - name: "CreateDockerImage"
          action: "aws:runCommand"
          onFailure: "step:signalfailure"
          inputs:
            DocumentName: "AWS-RunRemoteScript"
            InstanceIds:
            - "{{getInstanceId.InstanceId}}"
            CloudWatchOutputConfig:
              CloudWatchOutputEnabled: "true"
            Parameters:
              sourceType: "S3"
              sourceInfo:
                !Sub
                  - '{"path": "https://${S3Bucket}.s3.${S3Region}.amazonaws.com/{{QSS3KeyPrefix}}scripts/Dockerfile"}'
                  - S3Bucket: !If 
                      - UsingDefaultBucket
                      - !Sub '${QSS3BucketName}-${AWS::Region}'
                      - !Ref QSS3BucketName
                    S3Region: !If 
                      - UsingDefaultBucket
                      - !Ref AWS::Region
                      - !Ref QSS3BucketRegion
              commandLine: "docker build -t {{ECRRepoName}}:latest -m 2GB ."
        - name: "PushDockerImagetoECR"
          action: aws:runCommand
          onFailure: "step:signalfailure"
          inputs:
            DocumentName: AWS-RunPowerShellScript
            InstanceIds: 
              - "{{getInstanceId.InstanceId}}"
            CloudWatchOutputConfig:
              CloudWatchOutputEnabled: "true"
            Parameters:
              commands: 
                - |     
                   $Region = (Invoke-RestMethod -Method Get -Uri http://169.254.169.254/latest/dynamic/instance-identity/document).region
                   $AccountID = (Invoke-RestMethod -Method Get -Uri http://169.254.169.254/latest/dynamic/instance-identity/document).accountId
        
                   $ecrurl = $AccountID + '.dkr.ecr.' + $Region + '.amazonaws.com/{{ECRRepoName}}:latest'
        
                   Invoke-Expression -Command (Get-ECRLoginCommand -Region $Region).Command
                   docker tag {{ECRRepoName}}:latest $ecrurl
                   docker push $ecrurl
        # Determines if CFN Needs to be Signaled or if Work flow should just end
        - name: CFNSignalEnd
          action: aws:branch
          inputs:
            Choices:
            - NextStep: signalsuccess
              Not: 
                Variable: "{{StackName}}"
                StringEquals: ""
            - NextStep: sleepend
              Variable: "{{StackName}}"
              StringEquals: ""
        # If all steps complete successfully signals CFN of Success
        - name: "signalsuccess"
          action: "aws:executeAwsApi"
          nextStep: "deleteStack"
          inputs:
            Service: cloudformation
            Api: SignalResource
            LogicalResourceId: "SSMWaitCondition"
            StackName: "{{StackName}}"
            Status: SUCCESS
            UniqueId: "SSMWaitCondition"
        # If CFN Signl Not Needed this sleep ends work flow
        - name: "sleepend"
          action: "aws:sleep"
          nextStep: "deleteStack"
          inputs:
            Duration: PT1S
        # If any steps fails signals CFN of Failure
        - name: "signalfailure"
          action: "aws:executeAwsApi"
          nextStep: "deleteStack"
          inputs:
            Service: cloudformation
            Api: SignalResource
            LogicalResourceId: "SSMWaitCondition"
            StackName: "{{StackName}}"
            Status: FAILURE
            UniqueId: "SSMWaitCondition"
        - name: deleteStack
          action: aws:deleteStack
          isEnd: true
          onFailure: Continue
          inputs:
            StackName: !Sub "DotNetContainer-${AWS::StackName}"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



