DevOps Tutorial— Implement and Deploy Codepipeline with Github and CloudFormation

When it comes down to industry best practices for DevOps, CodePipeline come to mind. CodePipeline is a continuous delivery service you can use to model, visualize, and automate the steps required to release your software. You can quickly model and configure the different stages of a software release process. CodePipeline automates the steps required to release your software changes continuously.

This AWS service is carefree, low cost, highly automated. Combining with version control solution such as github, it minimizes the chance of having human error for continuous integration and continuous delivery(CI/CD).

Here are the parameters used that are responsible for Github credentials such as Github OAuth Token, repo, owner, branch as well as the application stack name, which is later used to identify which stack it belongs to.

In term of resources, below is the architecture diagram, there are few different services being used for the pipeline.

1. The IAM role defined in cloudformation is needed for the codepipeline which includes the permission sets being used for the infrastructure the pipeline will be allowed to access. Note that the pipeline currently uses Administration Access which will allow the pipeline to access all resources needed. In production, it is strongly recommended for the IAM role to have least privilege possible, which means it only allows the permission that users need
2. S3 Bucket is used to store artifacts and states that is needed to persist after the pipeline run through, which is defined in the template here.
3. The pipeline has three phases, the first phase requires input from parameters which include the github users, repository, and branch, as well as the artifacts storage solution such as S3.
4. CodeDeploy: Since this feature is a change in infrastructure via cloudformation template, the codedeploy feature will use cloudformation template as a provider.

AWSTemplateFormatVersion: '2010-09-09'
# *** Change this to something useful for you!
Description: github-codepipeline
Parameters:
  # *** This value must always be passed in when creating / updating stack
  # "NoEcho" is set to true, for security, so token won't be visible when examining the resulting stack
  GitHubOAuthToken:
    Type: String
    NoEcho: true
    MinLength: 40
    MaxLength: 40
    AllowedPattern: '[a-z0-9]*'
# *** The remaining parameters should either be:
  # - overridden via changing "Default" here (PREFERABLE, since then they're in source control)
  # - or you can pass them in when creating / updating the stack
  
  # *** The owner of the Github repo for this application.
  GitHubOwner:
    Type: String
    Default: symphoniacloud
    AllowedPattern: "[A-Za-z0-9-]+"
GitHubRepo:
    Type: String
    Default: github-codepipeline
    AllowedPattern: "[A-Za-z0-9-]+"
GitHubBranch:
    Type: String
    Default: master
    AllowedPattern: "[A-Za-z0-9-]+"
# *** The stack name for the actual application we're deploying
  ApplicationStackName:
    Type: String
    Default: github-codepipeline-app
    AllowedPattern: "[A-Za-z0-9-]+"
Resources:
  PipelineArtifactsBucket:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled
CodePipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      ArtifactStore:
        Type: S3
        Location: !Ref PipelineArtifactsBucket
      RestartExecutionOnUpdate: true
      RoleArn: !GetAtt CodePipelineRole.Arn
      Stages:
      - Name: Source
        Actions:
        - Name: Source
          InputArtifacts: []
          ActionTypeId:
            Category: Source
            Owner: ThirdParty
            Version: 1
            Provider: GitHub
          OutputArtifacts:
          - Name: SourceCode
          Configuration:
            Owner: !Ref GitHubOwner
            Repo: !Ref GitHubRepo
            Branch: !Ref GitHubBranch
            PollForSourceChanges: false
            OAuthToken: !Ref GitHubOAuthToken
          RunOrder: 1
      # Build and Deploy, etc., stages would follow. Here is an example
      - Name: Deploy
        Actions:
        - Name: CloudFormationDeploy
          ActionTypeId:
            Category: Deploy
            Owner: AWS
            Provider: CloudFormation
            Version: '1'
          InputArtifacts:
            - Name: SourceCode
          Configuration:
            ActionMode: CREATE_UPDATE
            Capabilities: CAPABILITY_IAM
            RoleArn: !GetAtt CloudformationRole.Arn
            StackName: !Ref ApplicationStackName
            TemplatePath: !Sub "SourceCode::application.yaml"
          RunOrder: 1
# 'GithubWebhook' satisfies two requirements:
  # -- Means that updates are pushed from GitHub, rather than AWS having to poll
  # -- Means we can filter for required changes
  GithubWebhook:
    Type: 'AWS::CodePipeline::Webhook'
    Properties:
      Authentication: GITHUB_HMAC
      AuthenticationConfiguration:
        SecretToken: !Ref GitHubOAuthToken
      RegisterWithThirdParty: 'true'
      Filters:
      - JsonPath: "$.ref"
        MatchEquals: refs/heads/{Branch}
      TargetPipeline: !Ref CodePipeline
      TargetAction: Source
      TargetPipelineVersion: !GetAtt CodePipeline.Version
CodePipelineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: Allow
          Principal:
            Service: codepipeline.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess #TODO: Reduce permissions
CloudformationRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          Effect: Allow
          Principal:
            Service: cloudformation.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess #TODO: Reduce permissions

References

https://docs.aws.amazon.com/codepipeline/latest/userguide/welcome.html