DevOps Tutorial— Implement and Deploy Codepipeline with Github and CloudFormation

When it comes down to industry best practices for DevOps, CodePipeline come to mind. CodePipeline is a continuous delivery service you can use to model, visualize, and automate the steps required to release your software. You can quickly model and configure the different stages of a software release process. CodePipeline automates the steps required to release your software changes continuously.

This AWS service is carefree, low cost, highly automated. Combining with version control solution such as github, it minimizes the chance of having human error for continuous integration and continuous delivery(CI/CD).

Here are the parameters used that are responsible for Github credentials such as Github OAuth Token, repo, owner, branch as well as the application stack name, which is later used to identify which stack it belongs to.

In term of resources, below is the architecture diagram, there are few different services being used for the pipeline.

Image for post
Image for post
  1. The IAM role defined in cloudformation is needed for the codepipeline which includes the permission sets being used for the infrastructure the pipeline will be allowed to access. Note that the pipeline currently uses Administration Access which will allow the pipeline to access all resources needed. In production, it is strongly recommended for the IAM role to have least privilege possible, which means it only allows the permission that users need
AWSTemplateFormatVersion: '2010-09-09'
# *** Change this to something useful for you!
Description: github-codepipeline
Parameters:
# *** This value must always be passed in when creating / updating stack
# "NoEcho" is set to true, for security, so token won't be visible when examining the resulting stack
GitHubOAuthToken:
Type: String
NoEcho: true
MinLength: 40
MaxLength: 40
AllowedPattern: '[a-z0-9]*'
# *** The remaining parameters should either be:
# - overridden via changing "Default" here (PREFERABLE, since then they're in source control)
# - or you can pass them in when creating / updating the stack

# *** The owner of the Github repo for this application.
GitHubOwner:
Type: String
Default: symphoniacloud
AllowedPattern: "[A-Za-z0-9-]+"
GitHubRepo:
Type: String
Default: github-codepipeline
AllowedPattern: "[A-Za-z0-9-]+"
GitHubBranch:
Type: String
Default: master
AllowedPattern: "[A-Za-z0-9-]+"
# *** The stack name for the actual application we're deploying
ApplicationStackName:
Type: String
Default: github-codepipeline-app
AllowedPattern: "[A-Za-z0-9-]+"
Resources:
PipelineArtifactsBucket:
Type: AWS::S3::Bucket
Properties:
VersioningConfiguration:
Status: Enabled
CodePipeline:
Type: AWS::CodePipeline::Pipeline
Properties:
ArtifactStore:
Type: S3
Location: !Ref PipelineArtifactsBucket
RestartExecutionOnUpdate: true
RoleArn: !GetAtt CodePipelineRole.Arn
Stages:
- Name: Source
Actions:
- Name: Source
InputArtifacts: []
ActionTypeId:
Category: Source
Owner: ThirdParty
Version: 1
Provider: GitHub
OutputArtifacts:
- Name: SourceCode
Configuration:
Owner: !Ref GitHubOwner
Repo: !Ref GitHubRepo
Branch: !Ref GitHubBranch
PollForSourceChanges: false
OAuthToken: !Ref GitHubOAuthToken
RunOrder: 1
# Build and Deploy, etc., stages would follow. Here is an example
- Name: Deploy
Actions:
- Name: CloudFormationDeploy
ActionTypeId:
Category: Deploy
Owner: AWS
Provider: CloudFormation
Version: '1'
InputArtifacts:
- Name: SourceCode
Configuration:
ActionMode: CREATE_UPDATE
Capabilities: CAPABILITY_IAM
RoleArn: !GetAtt CloudformationRole.Arn
StackName: !Ref ApplicationStackName
TemplatePath: !Sub "SourceCode::application.yaml"
RunOrder: 1
# 'GithubWebhook' satisfies two requirements:
# -- Means that updates are pushed from GitHub, rather than AWS having to poll
# -- Means we can filter for required changes
GithubWebhook:
Type: 'AWS::CodePipeline::Webhook'
Properties:
Authentication: GITHUB_HMAC
AuthenticationConfiguration:
SecretToken: !Ref GitHubOAuthToken
RegisterWithThirdParty: 'true'
Filters:
- JsonPath: "$.ref"
MatchEquals: refs/heads/{Branch}
TargetPipeline: !Ref CodePipeline
TargetAction: Source
TargetPipelineVersion: !GetAtt CodePipeline.Version
CodePipelineRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
Effect: Allow
Principal:
Service: codepipeline.amazonaws.com
Action: sts:AssumeRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/AdministratorAccess #TODO: Reduce permissions
CloudformationRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
Effect: Allow
Principal:
Service: cloudformation.amazonaws.com
Action: sts:AssumeRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/AdministratorAccess #TODO: Reduce permissions

References

https://docs.aws.amazon.com/codepipeline/latest/userguide/welcome.html

Written by

Software consulting company that focuses on emerging technology such as AI, Blockchain, Cloud Computing, and Data Engineering, MERN Stack, and Fintech

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store