initial-pipeline/pipeline-setup.yml [784:870]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Action: "lambda:InvokeFunction"
      Principal: "events.amazonaws.com"
      SourceArn: !GetAtt CBPUEventRule.Arn

  ################### Pipeline ###################

  ### CodePipeline - Artifact Bucket
  PipelineBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: 'AES256'
      BucketName: !Join [ '-', [ !Ref ResourceName, !Ref "AWS::AccountId", !Ref "AWS::Region", 'artifacts'  ] ]

  ### CodePipeline - Service Role
  CodePipelineRole: 
    Type: AWS::IAM::Role
    Properties: 
      RoleName: !Join [ '-', [ !Ref ResourceName, 'codepipeline', 'service'  ] ]
      AssumeRolePolicyDocument: 
        Version: 2012-10-17
        Statement: 
          - 
            Effect: Allow
            Principal: 
              Service: 
                - codepipeline.amazonaws.com
            Action: 
              - sts:AssumeRole
      Path: /
      Policies: 
        - 
          PolicyName: ServicePolicy
          PolicyDocument: 
            Version: 2012-10-17
            Statement: 
              - 
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: '*'
              - 
                Effect: Allow
                Action:
                  - codecommit:*
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:ListObject
                Resource: [!Join [ '', [ !GetAtt 'PipelineBucket.Arn', '/*'  ] ], !GetAtt 'PipelineBucket.Arn' ]
              -
                Effect: Allow
                Action:
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds
                Resource: '*'
  
  ### CodePipeline
  CodePipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      ArtifactStore:
        Type: S3
        Location: !Ref PipelineBucket
      RoleArn: !GetAtt 'CodePipelineRole.Arn'
      Name: !Join [ '-', [ !Ref ResourceName, 'pipeline'  ] ]
      Stages:
        - Name: PullRequest
          Actions:
            - Name: AppSource
              ActionTypeId:
                Category: Source
                Owner: AWS
                Version: 1
                Provider: CodeCommit
              OutputArtifacts:
                - Name: "AppSource"
              Configuration:
                BranchName: "development"
                RepositoryName: !Join [ '-', [ !Ref ResourceName, 'app'  ] ]
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



supplemental/pipeline-setup-final.yml [880:966]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Action: "lambda:InvokeFunction"
      Principal: "events.amazonaws.com"
      SourceArn: !GetAtt CBPUEventRule.Arn

  ################### Pipeline ###################

  ### CodePipeline - Artifact Bucket
  PipelineBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: 'AES256'
      BucketName: !Join [ '-', [ !Ref ResourceName, !Ref "AWS::AccountId", !Ref "AWS::Region", 'artifacts'  ] ]

  ### CodePipeline - Service Role
  CodePipelineRole: 
    Type: AWS::IAM::Role
    Properties: 
      RoleName: !Join [ '-', [ !Ref ResourceName, 'codepipeline', 'service'  ] ]
      AssumeRolePolicyDocument: 
        Version: 2012-10-17
        Statement: 
          - 
            Effect: Allow
            Principal: 
              Service: 
                - codepipeline.amazonaws.com
            Action: 
              - sts:AssumeRole
      Path: /
      Policies: 
        - 
          PolicyName: ServicePolicy
          PolicyDocument: 
            Version: 2012-10-17
            Statement: 
              - 
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: '*'
              - 
                Effect: Allow
                Action:
                  - codecommit:*
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:ListObject
                Resource: [!Join [ '', [ !GetAtt 'PipelineBucket.Arn', '/*'  ] ], !GetAtt 'PipelineBucket.Arn' ]
              -
                Effect: Allow
                Action:
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds
                Resource: '*'
  
  ### CodePipeline
  CodePipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      ArtifactStore:
        Type: S3
        Location: !Ref PipelineBucket
      RoleArn: !GetAtt 'CodePipelineRole.Arn'
      Name: !Join [ '-', [ !Ref ResourceName, 'pipeline'  ] ]
      Stages:
        - Name: PullRequest
          Actions:
            - Name: AppSource
              ActionTypeId:
                Category: Source
                Owner: AWS
                Version: 1
                Provider: CodeCommit
              OutputArtifacts:
                - Name: "AppSource"
              Configuration:
                BranchName: "development"
                RepositoryName: !Join [ '-', [ !Ref ResourceName, 'app'  ] ]
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



