codepipeline-template.yaml [729:903]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                RunOrder: 5

          ### Build stage for DAST analysis with OWASP Zap  
          - Name: Production-Depoy
            Actions:
              - Name: DeployProdAction
                InputArtifacts:
                  - Name: SourceOutput
                ActionTypeId:
                  Category: Deploy
                  Owner: AWS
                  Version: '1'
                  Provider: ElasticBeanstalk
                Configuration:
                  ApplicationName: !Ref PRDApplicationName
                  EnvironmentName: !Ref PRDElasticBeanstalkEnvironment
                RunOrder: 6
        
        ### Store build artifacts in S3 bucket
        ArtifactStore:
          Type: S3
          Location: !Ref CodePipelineArtifactStoreBucket
          EncryptionKey: 
            Id: !GetAtt PipelineKMSKey.Arn
            Type: KMS
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline  

    #### SCA Analysis Build Project
    SCABuildProject:
      Type: AWS::CodeBuild::Project
      Properties:
        Description: Software Composite Analysis Build Project
        Artifacts:
          Type: CODEPIPELINE
        EncryptionKey: !GetAtt PipelineKMSKey.Arn
        Environment:
          ComputeType: BUILD_GENERAL1_SMALL
          Image: aws/codebuild/standard:4.0
          Type: LINUX_CONTAINER
          PrivilegedMode: true
        ServiceRole: !Ref 'StaticCodeAnalysisServiceRole'
        Source:
          Type: CODEPIPELINE
          BuildSpec: buildspec-owasp-depedency-check.yml 
        LogsConfig:
            CloudWatchLogs:
              GroupName: !Ref CloudWatchLogGroup
              Status: ENABLED
              StreamName: SCAnalysis
        QueuedTimeoutInMinutes: 10
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline 

    #### SAST amalysis codebuild project
    SASTBuildProject:
      Type: AWS::CodeBuild::Project
      Properties:
        Description: Static Code Analysis Build Project
        Artifacts:
          Type: CODEPIPELINE
        EncryptionKey: !GetAtt PipelineKMSKey.Arn
        Environment:
          ComputeType: BUILD_GENERAL1_SMALL
          Image: aws/codebuild/standard:4.0
          Type: LINUX_CONTAINER
          EnvironmentVariables:   ## adding environment variable from SSM parameter
            'Fn::If':
              - ScanWith_SonarQube
              -
                - Name: SonarQube_Access_Token
                  Type: PARAMETER_STORE
                  Value: !Ref SSMParameterForSonar
                - Name: SonarQube_URL
                  Type: PARAMETER_STORE
                  Value: !Ref SSMParameterSonarQubeURL
              - !Ref "AWS::NoValue"
          PrivilegedMode: true
        ServiceRole: !Ref 'StaticCodeAnalysisServiceRole'
        Source:
          Type: CODEPIPELINE
          BuildSpec: 
            Fn::If:
              - ScanWith_SonarQube ### If selected SAST tool is SonarQube it will load buildspec_SonarQube.yml if not, it will load buildspec_phpstan.yml
              - buildspec-sonarqube.yml 
              - buildspec-phpstan.yml
        LogsConfig:
            CloudWatchLogs:
              GroupName: !Ref CloudWatchLogGroup
              Status: ENABLED
              StreamName: SASTAnalysis
        QueuedTimeoutInMinutes: 10
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline                  
    
    #### DAST analysis codebuild project
    DASTBuildProject:
      Type: AWS::CodeBuild::Project
      Properties:
        Description: Dynamic Code Analysis Build Project
        Artifacts:
          Type: CODEPIPELINE
        EncryptionKey: !GetAtt PipelineKMSKey.Arn
        Environment:
          ComputeType: BUILD_GENERAL1_SMALL
          Image: aws/codebuild/standard:4.0
          Type: LINUX_CONTAINER
          PrivilegedMode: true
          EnvironmentVariables:   ## adding environment variable from SSM parameter
              - Name: OwaspZapApiKey
                Type: PARAMETER_STORE
                Value: !Ref SSMParameterForZapApiKey
              - Name: OwaspZapURL
                Type: PARAMETER_STORE
                Value: !Ref SSMParameterOwaspZapURL
              - Name: ApplicationURL
                Type: PARAMETER_STORE
                Value: !Ref SSMParameterAppURL
        ServiceRole: !Ref 'StaticCodeAnalysisServiceRole'
        Source:
          Type: CODEPIPELINE
          BuildSpec: 
            Fn::If:
              - ScanWith_OWASP-ZAP ### If selected SAST tool is SonarQube it will load buildspec_SonarQube.yml if not, it will load buildspec_phpstan.yml
              - buildspec-owasp-zap.yml
              - buildspec-qualys.yml
        LogsConfig:
            CloudWatchLogs:
              GroupName: !Ref CloudWatchLogGroup
              Status: ENABLED
              StreamName: DASTAnalysis
        QueuedTimeoutInMinutes: 10
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline       
        

    ###StaticCode Analysis ServiceRole
    StaticCodeAnalysisServiceRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action: sts:AssumeRole
              Principal:
                Service:
                  - codebuild.amazonaws.com
        Policies:
          - PolicyName: SecurityCodeAnalysisPolicy
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action: iam:PassRole
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - iam:PassRole
                    - logs:*
                    - s3:*
                    - cloudformation:*
                    - cloudwatch:*
                    - cloudtrail:*
                    - codebuild:*
                    - codecommit:*
                    - codepipeline:*
                    - ssm:*
                    - lambda:*
                    - kms:*
                    - ecr:*
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



workshop/templates/devsecops-codepipeline.yaml [741:915]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                RunOrder: 5

          ### Build stage for DAST analysis with OWASP Zap  
          - Name: Production-Depoy
            Actions:
              - Name: DeployProdAction
                InputArtifacts:
                  - Name: SourceOutput
                ActionTypeId:
                  Category: Deploy
                  Owner: AWS
                  Version: '1'
                  Provider: ElasticBeanstalk
                Configuration:
                  ApplicationName: !Ref PRDApplicationName
                  EnvironmentName: !Ref PRDElasticBeanstalkEnvironment
                RunOrder: 6
        
        ### Store build artifacts in S3 bucket
        ArtifactStore:
          Type: S3
          Location: !Ref CodePipelineArtifactStoreBucket
          EncryptionKey: 
            Id: !GetAtt PipelineKMSKey.Arn
            Type: KMS
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline  

    #### SCA Analysis Build Project
    SCABuildProject:
      Type: AWS::CodeBuild::Project
      Properties:
        Description: Software Composite Analysis Build Project
        Artifacts:
          Type: CODEPIPELINE
        EncryptionKey: !GetAtt PipelineKMSKey.Arn
        Environment:
          ComputeType: BUILD_GENERAL1_SMALL
          Image: aws/codebuild/standard:4.0
          Type: LINUX_CONTAINER
          PrivilegedMode: true
        ServiceRole: !Ref 'StaticCodeAnalysisServiceRole'
        Source:
          Type: CODEPIPELINE
          BuildSpec: buildspec-owasp-depedency-check.yml 
        LogsConfig:
            CloudWatchLogs:
              GroupName: !Ref CloudWatchLogGroup
              Status: ENABLED
              StreamName: SCAnalysis
        QueuedTimeoutInMinutes: 10
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline 

    #### SAST amalysis codebuild project
    SASTBuildProject:
      Type: AWS::CodeBuild::Project
      Properties:
        Description: Static Code Analysis Build Project
        Artifacts:
          Type: CODEPIPELINE
        EncryptionKey: !GetAtt PipelineKMSKey.Arn
        Environment:
          ComputeType: BUILD_GENERAL1_SMALL
          Image: aws/codebuild/standard:4.0
          Type: LINUX_CONTAINER
          EnvironmentVariables:   ## adding environment variable from SSM parameter
            'Fn::If':
              - ScanWith_SonarQube
              -
                - Name: SonarQube_Access_Token
                  Type: PARAMETER_STORE
                  Value: !Ref SSMParameterForSonar
                - Name: SonarQube_URL
                  Type: PARAMETER_STORE
                  Value: !Ref SSMParameterSonarQubeURL
              - !Ref "AWS::NoValue"
          PrivilegedMode: true
        ServiceRole: !Ref 'StaticCodeAnalysisServiceRole'
        Source:
          Type: CODEPIPELINE
          BuildSpec: 
            Fn::If:
              - ScanWith_SonarQube ### If selected SAST tool is SonarQube it will load buildspec_SonarQube.yml if not, it will load buildspec_phpstan.yml
              - buildspec-sonarqube.yml 
              - buildspec-phpstan.yml
        LogsConfig:
            CloudWatchLogs:
              GroupName: !Ref CloudWatchLogGroup
              Status: ENABLED
              StreamName: SASTAnalysis
        QueuedTimeoutInMinutes: 10
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline                  
    
    #### DAST analysis codebuild project
    DASTBuildProject:
      Type: AWS::CodeBuild::Project
      Properties:
        Description: Dynamic Code Analysis Build Project
        Artifacts:
          Type: CODEPIPELINE
        EncryptionKey: !GetAtt PipelineKMSKey.Arn
        Environment:
          ComputeType: BUILD_GENERAL1_SMALL
          Image: aws/codebuild/standard:4.0
          Type: LINUX_CONTAINER
          PrivilegedMode: true
          EnvironmentVariables:   ## adding environment variable from SSM parameter
              - Name: OwaspZapApiKey
                Type: PARAMETER_STORE
                Value: !Ref SSMParameterForZapApiKey
              - Name: OwaspZapURL
                Type: PARAMETER_STORE
                Value: !Ref SSMParameterOwaspZapURL
              - Name: ApplicationURL
                Type: PARAMETER_STORE
                Value: !Ref SSMParameterAppURL
        ServiceRole: !Ref 'StaticCodeAnalysisServiceRole'
        Source:
          Type: CODEPIPELINE
          BuildSpec: 
            Fn::If:
              - ScanWith_OWASP-ZAP ### If selected SAST tool is SonarQube it will load buildspec_SonarQube.yml if not, it will load buildspec_phpstan.yml
              - buildspec-owasp-zap.yml
              - buildspec-qualys.yml
        LogsConfig:
            CloudWatchLogs:
              GroupName: !Ref CloudWatchLogGroup
              Status: ENABLED
              StreamName: DASTAnalysis
        QueuedTimeoutInMinutes: 10
        Tags:
          - Key: pipeline-name
            Value: !Sub ${AWS::StackName}-pipeline       
        

    ###StaticCode Analysis ServiceRole
    StaticCodeAnalysisServiceRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action: sts:AssumeRole
              Principal:
                Service:
                  - codebuild.amazonaws.com
        Policies:
          - PolicyName: SecurityCodeAnalysisPolicy
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action: iam:PassRole
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - iam:PassRole
                    - logs:*
                    - s3:*
                    - cloudformation:*
                    - cloudwatch:*
                    - cloudtrail:*
                    - codebuild:*
                    - codecommit:*
                    - codepipeline:*
                    - ssm:*
                    - lambda:*
                    - kms:*
                    - ecr:*
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



