workshop-2/ws3-start/core.yml [643:804]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              - Resource: !Sub arn:aws:s3:::${MythicalArtifactBucket}/*
                Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:GetObjectVersion
              - Resource: 
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/${MythicalLikeLogGroup}/codebuild/tests/
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/${MythicalLikeLogGroup}/codebuild/tests:*
                Effect: Allow
                Action: 
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvent
              - Resource:
                  - !Sub arn:aws:s3:::codepipeline-${AWS::Region}-*
                Effect: Allow
                Action: 
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion  
  
  # CodeBuild needs a place to put artifacts in the interim. This bucket is where it goes
  
  MythicalArtifactBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete 
  
  # Actual CodeBuild project that builds the Docker images and outputs imagedefinitions.json 
  
  DockerBuildCodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: "CODEPIPELINE"
      Source:
        Type: "CODEPIPELINE"
        BuildSpec: "buildspec_prod.yml"
      Environment:
        PrivilegedMode: true
        ComputeType: "BUILD_GENERAL1_SMALL"
        Image: "aws/codebuild/docker:17.09.0"
        Type: "LINUX_CONTAINER"
        EnvironmentVariables:
        - Name: AWS_ACCOUNT_ID
          Value: !Ref AWS::AccountId
          Type: PLAINTEXT
      Name: !Sub ${AWS::StackName}-like-service-build
      ServiceRole: !Ref CodeBuildServiceRole
  
  # CodePipeline for deployments. Uses CodeCommit + CodeBuild + ECS, deploying
  # to an existing ECS service. It looks for imagedefinitions.json as well as 
  # buildspec_prod for this
  
  MythicalLikeServicePipeline:
    Type: 'AWS::CodePipeline::Pipeline'
    Properties:
      ArtifactStore:
        Type: S3
        Location: !Ref MythicalArtifactBucket
      Name: !Sub ${AWS::StackName}
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      Stages:
        - Name: 'Source'
          Actions:
            - Name: 'Source'
              ActionTypeId:
                Category: 'Source'
                Owner: 'AWS'
                Version: '1'
                Provider: 'CodeCommit'
              OutputArtifacts:
                - Name: SourceArtifact
              Configuration:
                PollForSourceChanges: 'false'
                BranchName: master
                RepositoryName: !GetAtt MythicalLikeGitRepository.Name
              RunOrder: 1
        - Name: 'Build_Docker_Container'
          Actions:
            - Name: CodeBuild
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              InputArtifacts:
                - Name: SourceArtifact
              OutputArtifacts:
                - Name: BuildArtifact
              Configuration:
                ProjectName: !Ref DockerBuildCodeBuildProject
              RunOrder: 1
        - Name: Deploy
          Actions:
            - Name: Deploy
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: ECS
              InputArtifacts:
                - Name: BuildArtifact
              Configuration:
                ClusterName: !Ref MythicalEcsCluster
                ServiceName: !Sub ${AWS::StackName}_Mythical-Like-Service
                FileName: imagedefinitions.json
              RunOrder: 1
              
  # CodePipeline does not automatically create this for you as part of 
  # creation, but this role is for the CWE Hook to trigger CodePipeline once 
  # there's an update in CodeCommit. Otherwise, we have to have CodePipeline  
  # poll for changes, which is slower.            
  CodeCommitCloudWatchEventRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        -
          PolicyName: cwe-pipeline-execution
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action: codepipeline:StartPipelineExecution
                Resource: !Sub arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${MythicalLikeServicePipeline}
  
  # Actual CWE Rule to push changes over to CodePipeline.
                            
  CodeCommitCloudWatchEventRule:
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        source:
          - aws.codecommit
        detail-type:
          - 'CodeCommit Repository State Change'
        resources:
          - !GetAtt MythicalLikeGitRepository.Arn
        detail:
          event:
            - referenceCreated
            - referenceUpdated
          referenceType:
            - branch
          referenceName:
            - master
      Targets:
        -
          Arn: !Sub arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${MythicalLikeServicePipeline}
          RoleArn: !GetAtt CodeCommitCloudWatchEventRole.Arn
          Id: codepipeline-LikePipeline
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



workshop-3/core.yml [695:856]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              - Resource: !Sub arn:aws:s3:::${MythicalArtifactBucket}/*
                Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:GetObjectVersion
              - Resource: 
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/${MythicalLikeLogGroup}/codebuild/tests/
                  - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/${MythicalLikeLogGroup}/codebuild/tests:*
                Effect: Allow
                Action: 
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvent
              - Resource:
                  - !Sub arn:aws:s3:::codepipeline-${AWS::Region}-*
                Effect: Allow
                Action: 
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion  
  
  # CodeBuild needs a place to put artifacts in the interim. This bucket is where it goes
  
  MythicalArtifactBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete 
  
  # Actual CodeBuild project that builds the Docker images and outputs imagedefinitions.json 
  
  DockerBuildCodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: "CODEPIPELINE"
      Source:
        Type: "CODEPIPELINE"
        BuildSpec: "buildspec_prod.yml"
      Environment:
        PrivilegedMode: true
        ComputeType: "BUILD_GENERAL1_SMALL"
        Image: "aws/codebuild/docker:17.09.0"
        Type: "LINUX_CONTAINER"
        EnvironmentVariables:
        - Name: AWS_ACCOUNT_ID
          Value: !Ref AWS::AccountId
          Type: PLAINTEXT
      Name: !Sub ${AWS::StackName}-like-service-build
      ServiceRole: !Ref CodeBuildServiceRole
  
  # CodePipeline for deployments. Uses CodeCommit + CodeBuild + ECS, deploying
  # to an existing ECS service. It looks for imagedefinitions.json as well as 
  # buildspec_prod for this
  
  MythicalLikeServicePipeline:
    Type: 'AWS::CodePipeline::Pipeline'
    Properties:
      ArtifactStore:
        Type: S3
        Location: !Ref MythicalArtifactBucket
      Name: !Sub ${AWS::StackName}
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      Stages:
        - Name: 'Source'
          Actions:
            - Name: 'Source'
              ActionTypeId:
                Category: 'Source'
                Owner: 'AWS'
                Version: '1'
                Provider: 'CodeCommit'
              OutputArtifacts:
                - Name: SourceArtifact
              Configuration:
                PollForSourceChanges: 'false'
                BranchName: master
                RepositoryName: !GetAtt MythicalLikeGitRepository.Name
              RunOrder: 1
        - Name: 'Build_Docker_Container'
          Actions:
            - Name: CodeBuild
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: 1
                Provider: CodeBuild
              InputArtifacts:
                - Name: SourceArtifact
              OutputArtifacts:
                - Name: BuildArtifact
              Configuration:
                ProjectName: !Ref DockerBuildCodeBuildProject
              RunOrder: 1
        - Name: Deploy
          Actions:
            - Name: Deploy
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: 1
                Provider: ECS
              InputArtifacts:
                - Name: BuildArtifact
              Configuration:
                ClusterName: !Ref MythicalEcsCluster
                ServiceName: !Sub ${AWS::StackName}_Mythical-Like-Service
                FileName: imagedefinitions.json
              RunOrder: 1
              
  # CodePipeline does not automatically create this for you as part of 
  # creation, but this role is for the CWE Hook to trigger CodePipeline once 
  # there's an update in CodeCommit. Otherwise, we have to have CodePipeline  
  # poll for changes, which is slower.            
  CodeCommitCloudWatchEventRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        -
          PolicyName: cwe-pipeline-execution
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action: codepipeline:StartPipelineExecution
                Resource: !Sub arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${MythicalLikeServicePipeline}
  
  # Actual CWE Rule to push changes over to CodePipeline.
                            
  CodeCommitCloudWatchEventRule:
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        source:
          - aws.codecommit
        detail-type:
          - 'CodeCommit Repository State Change'
        resources:
          - !GetAtt MythicalLikeGitRepository.Arn
        detail:
          event:
            - referenceCreated
            - referenceUpdated
          referenceType:
            - branch
          referenceName:
            - master
      Targets:
        -
          Arn: !Sub arn:aws:codepipeline:${AWS::Region}:${AWS::AccountId}:${MythicalLikeServicePipeline}
          RoleArn: !GetAtt CodeCommitCloudWatchEventRole.Arn
          Id: codepipeline-LikePipeline
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



