java-app-backend/serverless-pipeline.yaml [33:273]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Conditions:
  NeedsApproval: !Equals [ !Ref ManualApproval, "true" ]

Resources:
  Artifacts:
    Type: AWS::S3::Bucket
    Properties:
      LifecycleConfiguration:
        Rules:
          - ExpirationInDays: 30
            Status: Enabled
      VersioningConfiguration:
        Status: Enabled

  ArtifactBucketPolicy:
    Type: AWS::S3::BucketPolicy

    Properties:
      Bucket: !Ref Artifacts
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Sid: "ServerlessApp"
            Effect: Allow
            Action:
              - s3:GetObject
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${Artifacts}/*
            Principal:
              Service:
                - serverlessrepo.amazonaws.com

  PipelineRole:
    Type: AWS::IAM::Role
    Properties:
      Description: !Sub "Used by CodePipeline. Created by CloudFormation ${AWS::StackId}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - "codepipeline.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: s3-access
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:DeleteObject"
                  - "s3:GetObject*"
                  - "s3:GetObjectVersion"
                  - "s3:PutObject"
                  - s3:PutObjectVersion
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::${Artifacts}/*
              - Effect: Allow
                Action:
                  - "s3:GetBucketVersioning"
                  - "s3:ListBucket"
                  - "s3:GetBucketPolicy"
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::${Artifacts}
        - PolicyName: codebuild-access
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "codebuild:StartBuild"
                  - "codebuild:BatchGetBuilds"
                Resource:
                  - !GetAtt BuildProject.Arn
        - PolicyName: deploy-cloudformation-access
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "cloudformation:DescribeStacks"
                  - "cloudformation:CreateChangeSet"
                  - "cloudformation:ExecuteChangeSet"
                  - "cloudformation:DescribeChangeSet"
                Resource:
                  - !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${DeployStackName}/*
        - PolicyName: deploy-iam-access
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "iam:PassRole"
                Resource:
                  - !GetAtt CloudFormationExecutionRole.Arn

  CloudFormationExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          Action:
            - 'sts:AssumeRole'
          Effect: Allow
          Principal:
            Service:
              - cloudformation.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AdministratorAccess'

  BuildProjectRole:
    Type: AWS::IAM::Role
    Properties:
      Description: !Sub "Used in CodeBuild project. Created by CloudFormation ${AWS::StackId}"
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
        Version: '2012-10-17'
      Path: /service-role/

  DeployStagePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub deploy-stage-access-${AWS::StackName}
      Roles:
        - !Ref CloudFormationExecutionRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
              - s3:GetObject
            Effect: Allow
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${Artifacts}/*

  AmazonCloudWatchEventRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: cwe-pipeline-execution
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: codepipeline:StartPipelineExecution
                Resource: !Join [ '', [ 'arn:aws:codepipeline:', !Ref 'AWS::Region', ':', !Ref 'AWS::AccountId', ':', !Ref Pipeline ] ]

  AmazonCloudWatchEventRule:
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        source:
          - aws.s3
        detail-type:
          - 'AWS API Call via CloudTrail'
        detail:
          eventSource:
            - s3.amazonaws.com
          eventName:
            - CopyObject
            - PutObject
            - CompleteMultipartUpload
          requestParameters:
            bucketName:
              - !Ref Artifacts
            key:
              - backend-source.zip
      Targets:
        - Arn:
            !Join [ '', [ 'arn:aws:codepipeline:', !Ref 'AWS::Region', ':', !Ref 'AWS::AccountId', ':', !Ref Pipeline ] ]
          RoleArn: !GetAtt AmazonCloudWatchEventRole.Arn
          Id: codepipeline-AppPipeline

  AWSCloudTrailBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref AWSCloudTrailBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AWSCloudTrailAclCheck
            Effect: Allow
            Principal:
              Service:
                - cloudtrail.amazonaws.com
            Action: s3:GetBucketAcl
            Resource: !GetAtt AWSCloudTrailBucket.Arn
          - Sid: AWSCloudTrailWrite
            Effect: Allow
            Principal:
              Service:
                - cloudtrail.amazonaws.com
            Action: s3:PutObject
            Resource: !Join [ '', [ !GetAtt AWSCloudTrailBucket.Arn, '/AWSLogs/', !Ref 'AWS::AccountId', '/*' ] ]
            Condition:
              StringEquals:
                s3:x-amz-acl: bucket-owner-full-control

  AWSCloudTrailBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain

  AwsCloudTrail:
    DependsOn:
      - AWSCloudTrailBucketPolicy
      - Artifacts
    Type: AWS::CloudTrail::Trail
    Properties:
      S3BucketName: !Ref AWSCloudTrailBucket
      EventSelectors:
        - DataResources:
            - Type: AWS::S3::Object
              Values:
                - !Join [ '', [ !GetAtt Artifacts.Arn, '/backend-source.zip'] ]
          ReadWriteType: WriteOnly
      IncludeGlobalServiceEvents: true
      IsLogging: true
      IsMultiRegionTrail: true

  DetectorBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



python-app-backend/serverless-pipeline.yaml [33:273]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Conditions:
  NeedsApproval: !Equals [ !Ref ManualApproval, "true" ]

Resources:
  Artifacts:
    Type: AWS::S3::Bucket
    Properties:
      LifecycleConfiguration:
        Rules:
          - ExpirationInDays: 30
            Status: Enabled
      VersioningConfiguration:
        Status: Enabled

  ArtifactBucketPolicy:
    Type: AWS::S3::BucketPolicy

    Properties:
      Bucket: !Ref Artifacts
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Sid: "ServerlessApp"
            Effect: Allow
            Action:
              - s3:GetObject
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${Artifacts}/*
            Principal:
              Service:
                - serverlessrepo.amazonaws.com

  PipelineRole:
    Type: AWS::IAM::Role
    Properties:
      Description: !Sub "Used by CodePipeline. Created by CloudFormation ${AWS::StackId}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - "codepipeline.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: s3-access
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:DeleteObject"
                  - "s3:GetObject*"
                  - "s3:GetObjectVersion"
                  - "s3:PutObject"
                  - s3:PutObjectVersion
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::${Artifacts}/*
              - Effect: Allow
                Action:
                  - "s3:GetBucketVersioning"
                  - "s3:ListBucket"
                  - "s3:GetBucketPolicy"
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::${Artifacts}
        - PolicyName: codebuild-access
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "codebuild:StartBuild"
                  - "codebuild:BatchGetBuilds"
                Resource:
                  - !GetAtt BuildProject.Arn
        - PolicyName: deploy-cloudformation-access
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "cloudformation:DescribeStacks"
                  - "cloudformation:CreateChangeSet"
                  - "cloudformation:ExecuteChangeSet"
                  - "cloudformation:DescribeChangeSet"
                Resource:
                  - !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/${DeployStackName}/*
        - PolicyName: deploy-iam-access
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "iam:PassRole"
                Resource:
                  - !GetAtt CloudFormationExecutionRole.Arn

  CloudFormationExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          Action:
            - 'sts:AssumeRole'
          Effect: Allow
          Principal:
            Service:
              - cloudformation.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AdministratorAccess'

  BuildProjectRole:
    Type: AWS::IAM::Role
    Properties:
      Description: !Sub "Used in CodeBuild project. Created by CloudFormation ${AWS::StackId}"
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
        Version: '2012-10-17'
      Path: /service-role/

  DeployStagePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub deploy-stage-access-${AWS::StackName}
      Roles:
        - !Ref CloudFormationExecutionRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
              - s3:GetObject
            Effect: Allow
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${Artifacts}/*

  AmazonCloudWatchEventRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: cwe-pipeline-execution
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: codepipeline:StartPipelineExecution
                Resource: !Join [ '', [ 'arn:aws:codepipeline:', !Ref 'AWS::Region', ':', !Ref 'AWS::AccountId', ':', !Ref Pipeline ] ]

  AmazonCloudWatchEventRule:
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        source:
          - aws.s3
        detail-type:
          - 'AWS API Call via CloudTrail'
        detail:
          eventSource:
            - s3.amazonaws.com
          eventName:
            - CopyObject
            - PutObject
            - CompleteMultipartUpload
          requestParameters:
            bucketName:
              - !Ref Artifacts
            key:
              - backend-source.zip
      Targets:
        - Arn:
            !Join [ '', [ 'arn:aws:codepipeline:', !Ref 'AWS::Region', ':', !Ref 'AWS::AccountId', ':', !Ref Pipeline ] ]
          RoleArn: !GetAtt AmazonCloudWatchEventRole.Arn
          Id: codepipeline-AppPipeline

  AWSCloudTrailBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref AWSCloudTrailBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AWSCloudTrailAclCheck
            Effect: Allow
            Principal:
              Service:
                - cloudtrail.amazonaws.com
            Action: s3:GetBucketAcl
            Resource: !GetAtt AWSCloudTrailBucket.Arn
          - Sid: AWSCloudTrailWrite
            Effect: Allow
            Principal:
              Service:
                - cloudtrail.amazonaws.com
            Action: s3:PutObject
            Resource: !Join [ '', [ !GetAtt AWSCloudTrailBucket.Arn, '/AWSLogs/', !Ref 'AWS::AccountId', '/*' ] ]
            Condition:
              StringEquals:
                s3:x-amz-acl: bucket-owner-full-control

  AWSCloudTrailBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain

  AwsCloudTrail:
    DependsOn:
      - AWSCloudTrailBucketPolicy
      - Artifacts
    Type: AWS::CloudTrail::Trail
    Properties:
      S3BucketName: !Ref AWSCloudTrailBucket
      EventSelectors:
        - DataResources:
            - Type: AWS::S3::Object
              Values:
                - !Join [ '', [ !GetAtt Artifacts.Arn, '/backend-source.zip'] ]
          ReadWriteType: WriteOnly
      IncludeGlobalServiceEvents: true
      IsLogging: true
      IsMultiRegionTrail: true

  DetectorBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



