serverless-rest-api/python-http-sam/pipeline.yaml [82:390]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Tags:
        - Key: "Stack"
          Value: !Ref AWS::StackName

  # Pipeline for building and deploying project
  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      ArtifactStore:
        Location: !Ref BuildArtifactsBucket
        Type: S3
      Name: !Ref AWS::StackName
      RoleArn: !GetAtt CodePipelineExecutionRole.Arn
      Stages:
        - Name: Source
          Actions:
            - Name: SourceCodeRepo
              ActionTypeId:
                Category: Source
                Owner: AWS
                Provider: CodeCommit
                Version: "1"
              Configuration:
                RepositoryName: !GetAtt CodeRepository.Name
                BranchName: main
              OutputArtifacts:
                - Name: SourceCodeAsZip
              RunOrder: 1
        - Name: Build
          Actions:
            - Name: CodeBuild
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: "1"
              Configuration:
                ProjectName: !Ref CodeBuildProject
              InputArtifacts:
                - Name: SourceCodeAsZip
              OutputArtifacts:
                - Name: BuildArtifactAsZip
        - Name: Testing
          Actions:
            - Name: CreateCognitoChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_REPLACE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Cognito-Testing
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Cognito-Testing
                TemplatePath: BuildArtifactAsZip::cognito.yaml
                Capabilities: CAPABILITY_IAM
              InputArtifacts:
                - Name: BuildArtifactAsZip
              RunOrder: 1
            - Name: ExecuteCognitoChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Cognito-Testing
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Cognito-Testing
              OutputArtifacts:
                - Name: !Sub ${AWS::StackName}CognitoTestingChangeSet
              RunOrder: 2
            - Name: CreateApplicationChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_REPLACE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Testing
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Testing
                TemplatePath: BuildArtifactAsZip::application.yaml
                ParameterOverrides: !Sub '{"CognitoStackName": "${AWS::StackName}-Cognito-Testing"}'
                Capabilities: CAPABILITY_IAM
              InputArtifacts:
                - Name: BuildArtifactAsZip
              RunOrder: 1
            - Name: ExecuteApplicationChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Testing
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Testing
              OutputArtifacts:
                - Name: !Sub ${AWS::StackName}ApplicationTestingChangeSet
              RunOrder: 4
            - Name: IntegrationTest
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: "1"
              Configuration:
                ProjectName: !Ref IntegrationTestProject
              InputArtifacts:
                - Name: SourceCodeAsZip
              RunOrder: 5
        - Name: Deployment
          Actions:
            - Name: DeploymentApproval
              ActionTypeId:
                Category: Approval
                Owner: AWS
                Provider: Manual
                Version: "1"
              RunOrder: 1
            - Name: CreateCognitoChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_REPLACE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Cognito-Deployment
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Cognito-Deployment
                TemplatePath: BuildArtifactAsZip::cognito.yaml
                Capabilities: CAPABILITY_IAM
              InputArtifacts:
                - Name: BuildArtifactAsZip
              RunOrder: 2
            - Name: ExecuteCognitoChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Cognito-Deployment
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Cognito-Deployment
              OutputArtifacts:
                - Name: !Sub ${AWS::StackName}CognitoDeploymentChangeSet
              RunOrder: 3
            - Name: CreateApplicationChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_REPLACE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Deployment
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Deployment
                TemplatePath: BuildArtifactAsZip::application.yaml
                ParameterOverrides: !Sub '{"CognitoStackName": "${AWS::StackName}-Cognito-Deployment"}'
                Capabilities: CAPABILITY_IAM
              InputArtifacts:
                - Name: BuildArtifactAsZip
              RunOrder: 2
            - Name: ExecuteApplicationChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Deployment
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Deployment
              OutputArtifacts:
                - Name: !Sub ${AWS::StackName}DeploymentChangeSet
              RunOrder: 5

  # IAM roles/policies for the pipeline
  ApplicationCodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - "sts:AssumeRole"
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
      Path: /
      Policies:
        - PolicyName: CodeBuildLogs
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource:
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${AWS::StackName}*"
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${AWS::StackName}*:*"
        - PolicyName: CodeBuildArtifactsBucket
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetObject"
                  - "s3:GetObjectVersion"
                  - "s3:PutObject"
                Resource:
                  - !Sub "arn:aws:s3:::${BuildArtifactsBucket}/*"

  IntegrationTestCodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - "sts:AssumeRole"
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
      Path: /
      Policies:
        - PolicyName: CodeBuildLogs
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource:
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${AWS::StackName}*"
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${AWS::StackName}*:*"
        - PolicyName: CodeBuildArtifactsBucket
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetObject"
                  - "s3:GetObjectVersion"
                  - "s3:PutObject"
                Resource:
                  - !Sub "arn:aws:s3:::${BuildArtifactsBucket}/*"
        - PolicyName: CloudFormationAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: "cloudformation:DescribeStacks"
                Resource:
                  - !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}-Testing/*"
                  - !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}-Cognito-Testing/*"
        - PolicyName: ParameterStoreAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: "secretsmanager:GetRandomPassword"
                Resource: "*"
        - PolicyName: CognitoAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "cognito-idp:AdminDeleteUser"
                  - "cognito-idp:AdminConfirmSignUp"
                  - "cognito-idp:AdminAddUserToGroup"
                Resource:
                  - !Sub "arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/*"
        - PolicyName: DynamoDBAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "dynamodb:BatchGet*"
                  - "dynamodb:DescribeStream"
                  - "dynamodb:DescribeTable"
                  - "dynamodb:Get*"
                  - "dynamodb:Query"
                  - "dynamodb:Scan"
                  - "dynamodb:BatchWrite*"
                  - "dynamodb:CreateTable"
                  - "dynamodb:Delete*"
                  - "dynamodb:Update*"
                  - "dynamodb:PutItem"
                Resource:
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${AWS::StackName}*"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



serverless-rest-api/python-rest-sam/pipeline.yaml [82:390]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Tags:
        - Key: "Stack"
          Value: !Ref AWS::StackName

  # Pipeline for building and deploying project
  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      ArtifactStore:
        Location: !Ref BuildArtifactsBucket
        Type: S3
      Name: !Ref AWS::StackName
      RoleArn: !GetAtt CodePipelineExecutionRole.Arn
      Stages:
        - Name: Source
          Actions:
            - Name: SourceCodeRepo
              ActionTypeId:
                Category: Source
                Owner: AWS
                Provider: CodeCommit
                Version: "1"
              Configuration:
                RepositoryName: !GetAtt CodeRepository.Name
                BranchName: main
              OutputArtifacts:
                - Name: SourceCodeAsZip
              RunOrder: 1
        - Name: Build
          Actions:
            - Name: CodeBuild
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: "1"
              Configuration:
                ProjectName: !Ref CodeBuildProject
              InputArtifacts:
                - Name: SourceCodeAsZip
              OutputArtifacts:
                - Name: BuildArtifactAsZip
        - Name: Testing
          Actions:
            - Name: CreateCognitoChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_REPLACE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Cognito-Testing
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Cognito-Testing
                TemplatePath: BuildArtifactAsZip::cognito.yaml
                Capabilities: CAPABILITY_IAM
              InputArtifacts:
                - Name: BuildArtifactAsZip
              RunOrder: 1
            - Name: ExecuteCognitoChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Cognito-Testing
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Cognito-Testing
              OutputArtifacts:
                - Name: !Sub ${AWS::StackName}CognitoTestingChangeSet
              RunOrder: 2
            - Name: CreateApplicationChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_REPLACE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Testing
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Testing
                TemplatePath: BuildArtifactAsZip::application.yaml
                ParameterOverrides: !Sub '{"CognitoStackName": "${AWS::StackName}-Cognito-Testing"}'
                Capabilities: CAPABILITY_IAM
              InputArtifacts:
                - Name: BuildArtifactAsZip
              RunOrder: 1
            - Name: ExecuteApplicationChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Testing
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Testing
              OutputArtifacts:
                - Name: !Sub ${AWS::StackName}ApplicationTestingChangeSet
              RunOrder: 4
            - Name: IntegrationTest
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: "1"
              Configuration:
                ProjectName: !Ref IntegrationTestProject
              InputArtifacts:
                - Name: SourceCodeAsZip
              RunOrder: 5
        - Name: Deployment
          Actions:
            - Name: DeploymentApproval
              ActionTypeId:
                Category: Approval
                Owner: AWS
                Provider: Manual
                Version: "1"
              RunOrder: 1
            - Name: CreateCognitoChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_REPLACE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Cognito-Deployment
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Cognito-Deployment
                TemplatePath: BuildArtifactAsZip::cognito.yaml
                Capabilities: CAPABILITY_IAM
              InputArtifacts:
                - Name: BuildArtifactAsZip
              RunOrder: 2
            - Name: ExecuteCognitoChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Cognito-Deployment
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Cognito-Deployment
              OutputArtifacts:
                - Name: !Sub ${AWS::StackName}CognitoDeploymentChangeSet
              RunOrder: 3
            - Name: CreateApplicationChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_REPLACE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Deployment
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Deployment
                TemplatePath: BuildArtifactAsZip::application.yaml
                ParameterOverrides: !Sub '{"CognitoStackName": "${AWS::StackName}-Cognito-Deployment"}'
                Capabilities: CAPABILITY_IAM
              InputArtifacts:
                - Name: BuildArtifactAsZip
              RunOrder: 2
            - Name: ExecuteApplicationChangeSet
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                ActionMode: CHANGE_SET_EXECUTE
                RoleArn: !GetAtt CloudFormationExecutionRole.Arn
                StackName: !Sub ${AWS::StackName}-Deployment
                ChangeSetName: !Sub ${AWS::StackName}-ChangeSet-Deployment
              OutputArtifacts:
                - Name: !Sub ${AWS::StackName}DeploymentChangeSet
              RunOrder: 5

  # IAM roles/policies for the pipeline
  ApplicationCodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - "sts:AssumeRole"
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
      Path: /
      Policies:
        - PolicyName: CodeBuildLogs
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource:
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${AWS::StackName}*"
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${AWS::StackName}*:*"
        - PolicyName: CodeBuildArtifactsBucket
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetObject"
                  - "s3:GetObjectVersion"
                  - "s3:PutObject"
                Resource:
                  - !Sub "arn:aws:s3:::${BuildArtifactsBucket}/*"

  IntegrationTestCodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - "sts:AssumeRole"
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
      Path: /
      Policies:
        - PolicyName: CodeBuildLogs
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource:
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${AWS::StackName}*"
                  - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${AWS::StackName}*:*"
        - PolicyName: CodeBuildArtifactsBucket
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetObject"
                  - "s3:GetObjectVersion"
                  - "s3:PutObject"
                Resource:
                  - !Sub "arn:aws:s3:::${BuildArtifactsBucket}/*"
        - PolicyName: CloudFormationAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: "cloudformation:DescribeStacks"
                Resource:
                  - !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}-Testing/*"
                  - !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${AWS::StackName}-Cognito-Testing/*"
        - PolicyName: ParameterStoreAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: "secretsmanager:GetRandomPassword"
                Resource: "*"
        - PolicyName: CognitoAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "cognito-idp:AdminDeleteUser"
                  - "cognito-idp:AdminConfirmSignUp"
                  - "cognito-idp:AdminAddUserToGroup"
                Resource:
                  - !Sub "arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/*"
        - PolicyName: DynamoDBAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "dynamodb:BatchGet*"
                  - "dynamodb:DescribeStream"
                  - "dynamodb:DescribeTable"
                  - "dynamodb:Get*"
                  - "dynamodb:Query"
                  - "dynamodb:Scan"
                  - "dynamodb:BatchWrite*"
                  - "dynamodb:CreateTable"
                  - "dynamodb:Delete*"
                  - "dynamodb:Update*"
                  - "dynamodb:PutItem"
                Resource:
                  - !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${AWS::StackName}*"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



