initial-pipeline/pipeline-setup.yml [956:1070]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  PrimarySource: "ConfigSource"
              RunOrder: 1

  ################### CodeBuild Projects ###################

  #### CodeBuild Dockerfile Analysis ####

  ### CodeBuild Service Role
  CodeBuildRole: 
    Type: AWS::IAM::Role
    Properties: 
      RoleName: !Join [ '-', [ !Ref ResourceName, 'codebuild', 'service'  ] ]
      AssumeRolePolicyDocument: 
        Version: 2012-10-17
        Statement: 
          - 
            Effect: Allow
            Principal: 
              Service: 
                - codebuild.amazonaws.com
            Action: 
              - sts:AssumeRole
      Path: /
      Policies: 
        - 
          PolicyName: ServicePolicy
          PolicyDocument: 
            Version: 2012-10-17
            Statement: 
              - 
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: '*'
              - 
                Effect: Allow
                Action:
                  - codecommit:*
                  - ssm:DescribeParameters
                  - ssm:GetParameter
                  - ssm:GetParameters
                  - ssm:PutParameter
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - ecr:*
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - lambda:InvokeFunction
                  - lambda:InvokeAsync
                Resource: !ImportValue 'AnchoreFargateStack:SendFindingsToSecurityHub'
              -
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:ListObject
                Resource: [!Join [ '', [ !GetAtt 'PipelineBucket.Arn', '/*'  ] ], !GetAtt 'PipelineBucket.Arn' ]

  ### CodeBuild Project - Dockerfile Analysis
  CodeBuildDFProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: 'BUILD_GENERAL1_SMALL'
        Image: aws/codebuild/docker:18.09.0
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: AWS_ACCOUNT_ID
            Type: PLAINTEXT
            Value: !Ref "AWS::AccountId"
      Name: !Join [ '-', [ !Ref ResourceName, 'build', 'dockerfile'  ] ]
      ServiceRole: !GetAtt 'CodeBuildRole.Arn'
      Source: 
        Type: CODEPIPELINE
        BuildSpec: buildspec_dockerfile.yml

  #### CodeBuild Project - Secrets Analysis ####
  CodeBuildSecretsProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: 'BUILD_GENERAL1_SMALL'
        Image: aws/codebuild/docker:18.09.0
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: AWS_ACCOUNT_ID
            Type: PLAINTEXT
            Value: !Ref "AWS::AccountId"
          - Name: APP_REPO_URL
            Type: PLAINTEXT
            Value: !GetAtt AppRepository.CloneUrlHttp
      Name: !Join [ '-', [ !Ref ResourceName, 'build', 'secrets'  ] ]
      ServiceRole: !GetAtt 'CodeBuildRole.Arn'
      Source: 
        Type: CODEPIPELINE
        BuildSpec: buildspec_secrets.yml

  #### CodeBuild Project - Vulnerability Scanning ####
  CodeBuildVulnProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



supplemental/pipeline-setup-final.yml [1050:1164]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  PrimarySource: "ConfigSource"
              RunOrder: 1

  ################### CodeBuild Projects ###################

  #### CodeBuild Dockerfile Analysis ####

  ### CodeBuild Service Role
  CodeBuildRole: 
    Type: AWS::IAM::Role
    Properties: 
      RoleName: !Join [ '-', [ !Ref ResourceName, 'codebuild', 'service'  ] ]
      AssumeRolePolicyDocument: 
        Version: 2012-10-17
        Statement: 
          - 
            Effect: Allow
            Principal: 
              Service: 
                - codebuild.amazonaws.com
            Action: 
              - sts:AssumeRole
      Path: /
      Policies: 
        - 
          PolicyName: ServicePolicy
          PolicyDocument: 
            Version: 2012-10-17
            Statement: 
              - 
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: '*'
              - 
                Effect: Allow
                Action:
                  - codecommit:*
                  - ssm:DescribeParameters
                  - ssm:GetParameter
                  - ssm:GetParameters
                  - ssm:PutParameter
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - ecr:*
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - lambda:InvokeFunction
                  - lambda:InvokeAsync
                Resource: !ImportValue 'AnchoreFargateStack:SendFindingsToSecurityHub'
              -
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:ListObject
                Resource: [!Join [ '', [ !GetAtt 'PipelineBucket.Arn', '/*'  ] ], !GetAtt 'PipelineBucket.Arn' ]

  ### CodeBuild Project - Dockerfile Analysis
  CodeBuildDFProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: 'BUILD_GENERAL1_SMALL'
        Image: aws/codebuild/docker:18.09.0
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: AWS_ACCOUNT_ID
            Type: PLAINTEXT
            Value: !Ref "AWS::AccountId"
      Name: !Join [ '-', [ !Ref ResourceName, 'build', 'dockerfile'  ] ]
      ServiceRole: !GetAtt 'CodeBuildRole.Arn'
      Source: 
        Type: CODEPIPELINE
        BuildSpec: buildspec_dockerfile.yml

  #### CodeBuild Project - Secrets Analysis ####
  CodeBuildSecretsProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: 'BUILD_GENERAL1_SMALL'
        Image: aws/codebuild/docker:18.09.0
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: AWS_ACCOUNT_ID
            Type: PLAINTEXT
            Value: !Ref "AWS::AccountId"
          - Name: APP_REPO_URL
            Type: PLAINTEXT
            Value: !GetAtt AppRepository.CloneUrlHttp
      Name: !Join [ '-', [ !Ref ResourceName, 'build', 'secrets'  ] ]
      ServiceRole: !GetAtt 'CodeBuildRole.Arn'
      Source: 
        Type: CODEPIPELINE
        BuildSpec: buildspec_secrets.yml

  #### CodeBuild Project - Vulnerability Scanning ####
  CodeBuildVulnProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



