block-production-demo-resources.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: "AWS CloudFormation template which contains the resources for block production demo."

Parameters:
 KeyName:
  Description: "Name of an existing EC2 KeyPair for SSH access to the instances."
  Type: "AWS::EC2::KeyPair::KeyName"
 AppName:
  Type: String
  Description: "Name of the application."
  MinLength: 2
  MaxLength: 30
  Default: "BlockProduction"
  ConstraintDescription: "Must be between 2 and 30 characters long, lowercase and may contain alphanumeric characters, hyphens (-), and dots (.), but must start with alphanumeric."
 DemoResourcesCodeCommitRepo:
  Type: String
  Default: "aws-codepipeline-block-production"
  Description: "Name of AWS CodeCommit repository that your application is in."
 DemoResourcesCodeCommitRepoBranch:
  Type: String
  Default: master
  Description: "AWS CodeCommit repository branch"
 DemoResourcesS3BucketName:
  Type: String
  Description: "Amazon S3 bucket where demo resources zip file was uploaded to."
 DemoResourcesS3ObjectKey:
  Type: String
  Description: "Amazon S3 object key with which demo resources zip file was uploaded to."
 CanaryApprovalConfiguration:
  Type: String
  Description: "Canary approval configuration in JSON format."
 YourIP:
  Description: "IP address to connect to SSH from. Check http://checkip.amazonaws.com/ to find yours."
  Type: String
  Default: "0.0.0.0/0"

Mappings:
 VPCIpSpace:
  us-east-1:
   RANGE: "10.42"
  us-west-2:
   RANGE: "10.43"
 SubnetTypeIpRanges:
  public:
   RANGE: "0.0/17"
 publicSubnetConfig:
  publicSubnet01:
   CIDR: "10.0/24"
 AWSRegionVirt2HVMAMI:
  us-east-1:
   HVM: "ami-8fcee4e5"
  us-west-2:
   HVM: "ami-63b25203"
 Constants:
  CloudWatchMetrics:
   Namespace: BlockProdDemo-SyntheticTestMetrics
   Name: Failure

Resources:

 MyVPC:
  Type: "AWS::EC2::VPC"
  Properties:
   CidrBlock:
    "Fn::Join": [ "", [ { "Fn::FindInMap": [ "VPCIpSpace", { "Ref": "AWS::Region" }, "RANGE" ] }, ".", "0.0/16" ] ]
   EnableDnsSupport: true
   EnableDnsHostnames: true
 publicSubnet01:
  Type: "AWS::EC2::Subnet"
  Properties:
   VpcId:
    Ref: MyVPC
   CidrBlock:
    "Fn::Join": [ "", [ { "Fn::FindInMap": [ "VPCIpSpace", { "Ref": "AWS::Region" }, "RANGE" ] }, ".", { "Fn::FindInMap": [ "publicSubnetConfig", "publicSubnet01", "CIDR" ] } ] ]
   AvailabilityZone:
    "Fn::Select": [ "0", { "Fn::GetAZs": { "Ref": "AWS::Region" } } ]

 InternetGateway:
  Type: "AWS::EC2::InternetGateway"

 AttachGateway:
  Type: "AWS::EC2::VPCGatewayAttachment"
  Properties:
   VpcId:
    Ref: MyVPC
   InternetGatewayId:
    Ref: InternetGateway

 PublicRouteTable:
  Type: "AWS::EC2::RouteTable"
  Properties:
   VpcId:
    Ref: MyVPC

 PublicRoute:
  Type: "AWS::EC2::Route"
  Properties:
   RouteTableId:
    Ref: PublicRouteTable
   DestinationCidrBlock: "0.0.0.0/0"
   GatewayId:
    Ref: InternetGateway

 PublicSubnetRTAssociation01:
  Type: "AWS::EC2::SubnetRouteTableAssociation"
  Properties:
   SubnetId:
    Ref: publicSubnet01
   RouteTableId:
    Ref: PublicRouteTable

 PublicNetworkAcl:
  Type: "AWS::EC2::NetworkAcl"
  Properties:
   VpcId:
    Ref: MyVPC

 InboundPublicNAclEntry:
  Type: "AWS::EC2::NetworkAclEntry"
  Properties:
   NetworkAclId:
    Ref: PublicNetworkAcl
   RuleNumber: 2000
   Protocol: "-1"
   RuleAction: allow
   Egress: false
   CidrBlock: "0.0.0.0/0"
   PortRange:
    From: 0
    To: 65535

 OutboundPublicNetworkAclEntry:
  Type: "AWS::EC2::NetworkAclEntry"
  Properties:
   NetworkAclId:
    Ref: PublicNetworkAcl
   RuleNumber: 2000
   Protocol: "-1"
   RuleAction: allow
   Egress: true
   CidrBlock: "0.0.0.0/0"
   PortRange:
    From: 0
    To: 65535

 publicSubnetNetworkAclAssociation01:
  Type: "AWS::EC2::SubnetNetworkAclAssociation"
  Properties:
   SubnetId:
    Ref: publicSubnet01
   NetworkAclId:
    Ref: PublicNetworkAcl

 ArtifactStoreBucket:
  Type: "AWS::S3::Bucket"

 WebAppRole:
  Type: "AWS::IAM::Role"
  Properties:
   AssumeRolePolicyDocument:
    Statement:
     - Effect: Allow
       Principal:
        Service: "ec2.amazonaws.com"
       Action: "sts:AssumeRole"
   ManagedPolicyArns:
    - "arn:aws:iam::aws:policy/AWSCodeDeployReadOnlyAccess"
    - "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess"
   Path: "/"

 WebAppRolePolicies:
  Type: "AWS::IAM::Policy"
  Properties:
   PolicyName: BackendRole
   PolicyDocument:
    Statement:
     - Effect: Allow
       Action:
          - "cloudwatch:PutMetricData"
       Resource: "*"
     - Effect: Allow
       Action:
        - "s3:GetObject"
       Resource:
        - "Fn::Join": ["", ["arn:aws:s3:::", {"Ref": "ArtifactStoreBucket"}, "/*" ]]
        - "Fn::Join": ["", ["arn:aws:s3:::aws-codedeploy-", {"Ref": "AWS::Region"}, "/*" ]]
   Roles:
    - Ref: WebAppRole

 WebAppInstanceProfile:
  Type: "AWS::IAM::InstanceProfile"
  Properties:
   Path: "/"
   Roles:
    - Ref: WebAppRole

 WebAppSG:
  Type: "AWS::EC2::SecurityGroup"
  Properties:
   GroupDescription: "Enable HTTP access on port 80"
   SecurityGroupIngress:
    - IpProtocol: tcp
      FromPort: 22
      ToPort: 22
      CidrIp: !Ref YourIP
    - IpProtocol: tcp
      FromPort: 80
      ToPort: 80
      CidrIp: "0.0.0.0/0"

 LaunchConfiguration:
  Type: "AWS::AutoScaling::LaunchConfiguration"
  Properties:
   IamInstanceProfile:
    Ref: WebAppInstanceProfile
   ImageId:
    "Fn::FindInMap": [ "AWSRegionVirt2HVMAMI", { "Ref": "AWS::Region" }, "HVM" ]
   InstanceType: "t2.micro"
   KeyName:
    Ref: KeyName
   SecurityGroups:
    - Ref: WebAppSG
   UserData:
    "Fn::Base64":
      "Fn::Join":
        - ""
        - [
          "#!/bin/bash -xe\n",

          "/usr/bin/yum -y update\n",
          "/usr/bin/yum install -y ruby\n",
          "/usr/bin/yum install -y aws-cli\n",
          "cd /home/ec2-user/\n",
          "/usr/bin/aws s3 cp s3://aws-codedeploy-", { "Ref" : "AWS::Region" }, "/latest/install . --region ", { "Ref" : "AWS::Region" }, "\n",
          "/bin/chmod +x ./install\n",
          "./install auto\n"
          ]

 CanaryAutoScalingGroup:
  Type: "AWS::AutoScaling::AutoScalingGroup"
  Properties:
   LoadBalancerNames:
    - Ref: ElasticLoadBalancer
   AvailabilityZones:
    "Fn::GetAZs": { "Ref": "AWS::Region" }
   DesiredCapacity: 1
   LaunchConfigurationName:
    Ref: LaunchConfiguration
   MinSize: 1
   MaxSize: 3

 ProdAutoScalingGroup:
  Type: "AWS::AutoScaling::AutoScalingGroup"
  Properties:
   LoadBalancerNames:
    - Ref: ElasticLoadBalancer
   AvailabilityZones:
    "Fn::GetAZs": { "Ref": "AWS::Region" }
   DesiredCapacity: 1
   LaunchConfigurationName:
    Ref: LaunchConfiguration
   MinSize: 1
   MaxSize: 3

 ElasticLoadBalancer:
  Type: "AWS::ElasticLoadBalancing::LoadBalancer"
  Properties:
   AvailabilityZones:
    "Fn::GetAZs": { "Ref": "AWS::Region" }
   Listeners:
    - LoadBalancerPort: 80
      InstancePort: 80
      Protocol: HTTP
   SecurityGroups:
    - {"Fn::GetAtt" : ["WebAppSG", "GroupId"]}

 JenkinsRole:
  Type: "AWS::IAM::Role"
  Properties:
   AssumeRolePolicyDocument:
    Statement:
     - Effect: Allow
       Principal:
        Service: "ec2.amazonaws.com"
       Action: "sts:AssumeRole"
   Path: "/"

 JenkinsRolePolicies:
  Type: "AWS::IAM::Policy"
  Properties:
   PolicyName: JenkinsRole
   PolicyDocument:
    Statement:
    - Effect: Allow
      Action:
       - "codepipeline:AcknowledgeJob"
       - "codepipeline:GetJobDetails"
       - "codepipeline:PollForJobs"
       - "codepipeline:PutJobFailureResult"
       - "codepipeline:PutJobSuccessResult"
      Resource: "*"
   Roles:
    - Ref: JenkinsRole

 JenkinsInstanceProfile:
  Type: "AWS::IAM::InstanceProfile"
  Properties:
   Path: "/"
   Roles:
    - Ref: JenkinsRole

 JenkinsSG:
  Type: "AWS::EC2::SecurityGroup"
  Properties:
   GroupDescription: "Enable HTTP access on port 80"
   VpcId:
    Ref: MyVPC
   SecurityGroupIngress:
    - IpProtocol: tcp
      FromPort: 22
      ToPort: 22
      CidrIp:
        Ref: YourIP
    - IpProtocol: tcp
      FromPort: 80
      ToPort: 80
      CidrIp:
        Ref: YourIP
   SecurityGroupEgress:
    - IpProtocol: tcp
      FromPort: 80
      ToPort: 80
      CidrIp: "0.0.0.0/0"
    - IpProtocol: tcp
      FromPort: 443
      ToPort: 443
      CidrIp: "0.0.0.0/0"
    - IpProtocol: udp
      FromPort: 123
      ToPort: 123
      CidrIp: "0.0.0.0/0"
    - IpProtocol: udp
      FromPort: 9418
      ToPort: 9418
      CidrIp: "0.0.0.0/0"
    - IpProtocol: icmp
      FromPort: "-1"
      ToPort: "-1"
      CidrIp: "0.0.0.0/0"

 JenkinsServer:
  Type: "AWS::EC2::Instance"
  Metadata:
   "AWS::CloudFormation::Init":
    config:
     packages:
      yum:
       "java-1.7.0-openjdk": []
       "java-1.7.0-openjdk-devel": []
     files:
      "/tmp/config.xml":
       source: "https://s3.amazonaws.com/aws-codedeploy-samples-us-east-1/templates/latest/Jenkins_Helper_Scripts/config.xml"
       mode: 644
      "/tmp/hudson.tasks.Maven.xml":
       source: "https://s3.amazonaws.com/aws-codedeploy-samples-us-east-1/templates/latest/Jenkins_Helper_Scripts/hudson.tasks.Maven.xml"
       mode: 644
      "/tmp/jenkins.mvn.GlobalMavenConfig.xml":
       source: "https://s3.amazonaws.com/aws-codedeploy-samples-us-east-1/templates/latest/Jenkins_Helper_Scripts/jenkins.mvn.GlobalMavenConfig.xml"
       mode: 644
  Properties:
   KeyName:
    Ref: KeyName
   ImageId:
    "Fn::FindInMap": [ "AWSRegionVirt2HVMAMI", { "Ref": "AWS::Region" }, "HVM" ]
   NetworkInterfaces:
    - SubnetId:
        Ref: publicSubnet01
      GroupSet:
        - Ref: JenkinsSG
      AssociatePublicIpAddress: true
      DeviceIndex: 0
   InstanceType: "t2.large"
   IamInstanceProfile:
    Ref: JenkinsInstanceProfile
   UserData:
     "Fn::Base64": {
       "Fn::Join": [
         "",
         [
           "#!/bin/bash -ex\n",
           "/usr/bin/yum update -y aws-cfn-bootstrap\n",
           "# Update the AWS CLI to the latest version\n",
           "/usr/bin/yum install -y aws-cli\n",
           "function error_exit\n",
           "{\n",
           "  /opt/aws/bin/cfn-signal -e 1 -r \"$1\" '",
           {
             "Ref": "JenkinsHostWaitHandle"
           },
           "'\n",
           "  exit 1\n",
           "}\n",
           "/opt/aws/bin/cfn-init -v -s ",
           {
             "Ref": "AWS::StackName"
           },
           " -r JenkinsServer --region ",
           {
             "Ref": "AWS::Region"
           },
           "\n",
           "# Install Maven\n",
           "cd /tmp/\n",
           "MAVEN_VERSION=3.3.9\n",
           "/usr/bin/wget https://archive.apache.org/dist/maven/maven-3/$MAVEN_VERSION/binaries/apache-maven-$MAVEN_VERSION-bin.tar.gz\n",
           "/bin/tar xzvf apache-maven-$MAVEN_VERSION-bin.tar.gz -C /opt/\n",
           "/bin/ln -s /opt/apache-maven-$MAVEN_VERSION /opt/apache-maven\n",
           "/bin/rm /tmp/apache-maven-$MAVEN_VERSION-bin.tar.gz\n",
           "# Install Jenkins\n",
           "/usr/bin/wget -O /etc/yum.repos.d/jenkins.repo http://pkg.jenkins-ci.org/redhat/jenkins.repo\n",
           "/bin/rpm --import http://pkg.jenkins-ci.org/redhat/jenkins-ci.org.key\n",
           "/usr/bin/yum install -y http://pkg.jenkins-ci.org/redhat/jenkins-1.658-1.1.noarch.rpm\n",
           "/sbin/service jenkins start\n",
           "/sbin/chkconfig jenkins on\n",
           "# Wait 30 seconds to allow Jenkins to startup\n",
           "/bin/echo \"Waiting 30 seconds for Jenkins to start.....\"\n",
           "/bin/sleep 30\n",
           "# Install the required plugins\n",
           "cd /var/lib/jenkins/plugins\n",
           "/usr/bin/curl -O -L https://updates.jenkins-ci.org/latest/aws-codepipeline.hpi\n",
           "/bin/chown jenkins:jenkins *.hpi\n",
           "/bin/mv /tmp/hudson.tasks.Maven.xml /var/lib/jenkins/\n",
           "/bin/mv /tmp/jenkins.mvn.GlobalMavenConfig.xml /var/lib/jenkins/\n",
           "/bin/chown jenkins:jenkins /var/lib/jenkins/*.xml\n",
           "# Restarting Jenkins\n",
           "/sbin/service jenkins restart\n",
           "/bin/echo \"Waiting 30 seconds for Jenkins to start.....\"\n",
           "/bin/sleep 30\n",
           "# configure our job\n",
           "/bin/sed -i \"s/APPNAME/",
           {
             "Ref": "AppName"
           },
           "/g\" /tmp/config.xml\n",
           "/bin/sed -i \"s/REGION/",
           {
             "Ref": "AWS::Region"
           },
           "/g\" /tmp/config.xml\n",
           "/usr/bin/java -jar /var/cache/jenkins/war/WEB-INF/jenkins-cli.jar -s http://localhost:8080 create-job ",
           {
             "Ref": "AppName"
           },
           "< /tmp/config.xml\n",
           "/bin/rm /tmp/config.xml\n",
           "# Set up port forwarding\n",
           "/sbin/iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080\n",
           "/sbin/iptables-save > /etc/sysconfig/iptables\n",
           "# If all went well, signal success\n",
           "/opt/aws/bin/cfn-signal -e $? -r 'Instance configuration complete' '",
           {
             "Ref": "JenkinsHostWaitHandle"
           },
           "'\n",
           "\n"
         ]
       ]
     }

 JenkinsHostWaitHandle:
  Type: "AWS::CloudFormation::WaitConditionHandle"

 JenkinsHostWaitCondition:
  Type: "AWS::CloudFormation::WaitCondition"
  DependsOn: JenkinsServer
  Properties:
   Handle:
    Ref: JenkinsHostWaitHandle
   Timeout: 600

 CodeDeployTrustRole:
  Type: "AWS::IAM::Role"
  Properties:
   AssumeRolePolicyDocument:
    Statement:
      - Sid: ""
        Effect: "Allow"
        Principal:
         Service:
          - "codedeploy.amazonaws.com"
        Action: "sts:AssumeRole"
   ManagedPolicyArns:
    - "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole"
   Path: "/"

 CodeDeployApp:
  Type: "AWS::CodeDeploy::Application"
  Properties:
   ApplicationName:
    Ref: AppName

 CanaryDeploymentGroup:
  DependsOn: CodeDeployTrustRole
  Type: "AWS::CodeDeploy::DeploymentGroup"
  Properties:
   ApplicationName:
    Ref: CodeDeployApp
   DeploymentGroupName:
      "Fn::Join": [ "", [ { "Ref": "AppName" }, "-CanaryEnv" ] ]
   DeploymentConfigName: "CodeDeployDefault.OneAtATime"
   ServiceRoleArn:
    "Fn::GetAtt": [ "CodeDeployTrustRole", "Arn" ]
   AutoScalingGroups:
    - Ref: CanaryAutoScalingGroup

 ProdDeploymentGroup:
  DependsOn: CodeDeployTrustRole
  Type: "AWS::CodeDeploy::DeploymentGroup"
  Properties:
   ApplicationName:
    Ref: CodeDeployApp
   DeploymentGroupName:
      "Fn::Join": [ "", [ { "Ref": "AppName" }, "-ProdEnv" ] ]
   DeploymentConfigName: "CodeDeployDefault.OneAtATime"
   ServiceRoleArn:
    "Fn::GetAtt": [ "CodeDeployTrustRole", "Arn" ]
   AutoScalingGroups:
    - Ref: ProdAutoScalingGroup

 CodePipelineTrustRole:
  Type: "AWS::IAM::Role"
  Properties:
   AssumeRolePolicyDocument:
    Statement:
     - Effect: Allow
       Principal:
        Service:
          - "codepipeline.amazonaws.com"
       Action: "sts:AssumeRole"
   Path: "/"

 CodePipelineRolePolicies:
  Type: "AWS::IAM::Policy"
  Properties:
   PolicyName: CodePipelinePolicy
   PolicyDocument:
    Statement:
      - Effect: Allow
        Action:
          - "codecommit:GetBranch"
          - "codecommit:GetCommit"
          - "codecommit:UploadArchive"
          - "codecommit:GetUploadArchiveStatus"
          - "codecommit:CancelUploadArchive"
        Resource: "*"
      - Effect: Allow
        Action:
          - "s3:GetObject"
          - "s3:PutObject"
        Resource:
          - "Fn::Join": ["", ["arn:aws:s3:::", {"Ref": "ArtifactStoreBucket"}, "/*" ]]
      - Effect: "Allow"
        Action:
          - "s3:ListBucket"
        Resource:
          - "Fn::Join": ["", ["arn:aws:s3:::", {"Ref": "ArtifactStoreBucket"}]]
      - Effect: Allow
        Action:
          - "codedeploy:CreateDeployment"
          - "codedeploy:GetApplicationRevision"
          - "codedeploy:GetDeployment"
          - "codedeploy:GetDeploymentConfig"
          - "codedeploy:RegisterApplicationRevision"
        Resource: "*"
      - Effect: Allow
        Action:
          - "sns:Publish"
        Resource: !Ref PipelineApprovalSNSNotification
   Roles:
    - Ref: CodePipelineTrustRole

 CustomJenkinsActionType:
  Type: "AWS::CodePipeline::CustomActionType"
  DependsOn: JenkinsHostWaitCondition
  Properties:
   Category: Build
   Provider:
    "Fn::Join": [ "", [ { "Ref": "AppName" }, "-Jenkins" ] ]
   Version: 1
   ConfigurationProperties:
    - Key: true
      Name: ProjectName
      Queryable: true
      Required: true
      Secret: false
      Type: String
   InputArtifactDetails:
    MaximumCount: 5
    MinimumCount: 0
   OutputArtifactDetails:
    MaximumCount: 5
    MinimumCount: 0
   Settings:
    EntityUrlTemplate:
      "Fn::Join": [ "", [ "http://", { "Fn::GetAtt": [ "JenkinsServer", "PublicIp" ] }, "/job/{Config:ProjectName}" ]]
    ExecutionUrlTemplate:
      "Fn::Join": [ "", [ "http://", { "Fn::GetAtt": [ "JenkinsServer", "PublicIp" ] }, "/job/{Config:ProjectName}/{ExternalExecutionId}" ]]

 Pipeline:
  Type: "AWS::CodePipeline::Pipeline"
  DependsOn: CustomJenkinsActionType
  Properties:
   Name:
    "Fn::Join": [ "", [ { "Ref": "AppName" }, "-Pipeline" ] ]
   RoleArn:
    "Fn::GetAtt": [ "CodePipelineTrustRole", "Arn" ]
   ArtifactStore:
    Type: S3
    Location:
     Ref: ArtifactStoreBucket
   Stages:
    - Name: Source
      Actions:
        - Name: DemoResourcesSource
          ActionTypeId:
            Version: 1
            Category: Source
            Owner: AWS
            Provider: CodeCommit
          OutputArtifacts:
            - Name: DemoSourceArtifacts
          Configuration:
            RepositoryName:
              Ref: DemoResourcesCodeCommitRepo
            BranchName:
              Ref: DemoResourcesCodeCommitRepoBranch
          RunOrder: 1
    - Name: Build
      Actions:
        - Name: ApplicationBuild
          InputArtifacts:
            - Name: DemoSourceArtifacts
          ActionTypeId:
            Category: Build
            Owner: Custom
            Version: 1
            Provider: {"Fn::Join": ["", [{"Ref": "AppName"}, "-Jenkins"]]}
          OutputArtifacts:
            - Name: DemoBuiltArtifacts
          Configuration:
            ProjectName:
              Ref: AppName
          RunOrder: 1
    - Name: Deploy
      Actions:
        - Name: CanaryDeploy
          InputArtifacts:
            - Name: DemoBuiltArtifacts
          ActionTypeId:
            Category: Deploy
            Owner: AWS
            Version: 1
            Provider: CodeDeploy
          Configuration:
            ApplicationName:
              Ref: CodeDeployApp
            DeploymentGroupName:
              Ref: CanaryDeploymentGroup
          RunOrder: 1
        - Name: CanaryApproval
          ActionTypeId:
            Category: Approval
            Owner: AWS
            Version: 1
            Provider: Manual
          Configuration:
            NotificationArn:
              Ref: PipelineApprovalSNSNotification
            CustomData:
              Ref: CanaryApprovalConfiguration
          RunOrder: 2
        - Name: ProdDeploy
          InputArtifacts:
            - Name: DemoBuiltArtifacts
          ActionTypeId:
            Category: Deploy
            Owner: AWS
            Version: 1
            Provider: CodeDeploy
          Configuration:
            ApplicationName:
              Ref: CodeDeployApp
            DeploymentGroupName:
              Ref: ProdDeploymentGroup
          RunOrder: 3

 PipelineAppovalTable:
  Type: "AWS::DynamoDB::Table"
  Properties:
   AttributeDefinitions:
    - AttributeName: ApprovalToken
      AttributeType: S
   KeySchema:
    - AttributeName: ApprovalToken
      KeyType: HASH
   ProvisionedThroughput:
    ReadCapacityUnits: 5
    WriteCapacityUnits: 5
   TableName: "BlockProductionDemo-PipelineApprovals"

 RegisterCanaryApprovalLambdaFunction:
  Type: "AWS::Lambda::Function"
  Properties:
   Handler: "register-canary-approval.handler"
   Role:
    "Fn::GetAtt":
     - RegisterCanaryApprovalFunctionExecutionRole
     - Arn
   Code:
    S3Bucket:
     Ref: DemoResourcesS3BucketName
    S3Key:
     Ref: DemoResourcesS3ObjectKey
   Runtime: "nodejs4.3"
   Timeout: 25

 RegisterCanaryApprovalFunctionExecutionRole:
  Type: "AWS::IAM::Role"
  Properties:
   AssumeRolePolicyDocument:
    Statement:
      - Effect: Allow
        Action:
         - "sts:AssumeRole"
        Principal:
          Service: ["lambda.amazonaws.com"]
    Version: "2012-10-17"
   Path: "/"
   Policies:
      - PolicyName: CloudWatchAccess
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - "logs:CreateLogGroup"
                - "logs:CreateLogStream"
                - "logs:PutLogEvents"
              Resource: "arn:aws:logs:*:*:*"
            - Effect: Allow
              Action:
                - "dynamodb:PutItem"
              Resource:
                - "Fn::Join": ["", ["arn:aws:dynamodb:", { "Ref" : "AWS::Region" }, ":", { "Ref" : "AWS::AccountId" }, ":table/", {"Ref": "PipelineAppovalTable"}]]

 RegisterCanaryApprovalInvokePermission:
  Type: "AWS::Lambda::Permission"
  Properties:
   FunctionName:
    "Fn::GetAtt":
     - RegisterCanaryApprovalLambdaFunction
     - Arn
   Action: "lambda:InvokeFunction"
   Principal: "sns.amazonaws.com"
   SourceArn:
    Ref: PipelineApprovalSNSNotification

 PipelineApprovalSNSNotification:
  Type: "AWS::SNS::Topic"
  Properties:
   Subscription:
    - Protocol: lambda
      Endpoint:
        "Fn::GetAtt":
          - RegisterCanaryApprovalLambdaFunction
          - Arn

 SyntheticTestFailureCloudWatchAlarm:
   DependsOn: Pipeline
   Type: AWS::CloudWatch::Alarm
   Properties:
     ComparisonOperator: GreaterThanOrEqualToThreshold
     # Set to a higher value to allow instances and load balancer to become healthy
     EvaluationPeriods: 10
     Namespace: !FindInMap [ Constants, CloudWatchMetrics, Namespace]
     MetricName: !FindInMap [ Constants, CloudWatchMetrics, Name]
     Period: 60
     Statistic: Sum
     Threshold: 1

 SyntheticTestFunctionExecutionRole:
   Type: AWS::IAM::Role
   Properties:
     AssumeRolePolicyDocument:
       Statement:
       - Action: ['sts:AssumeRole']
         Effect: Allow
         Principal:
           Service: [lambda.amazonaws.com]
       Version: '2012-10-17'
     Path: /
     Policies:
       - PolicyName: CloudWatchAccess
         PolicyDocument:
           Version: '2012-10-17'
           Statement:
             - Effect: Allow
               Action:
                 - "logs:CreateLogGroup"
                 - "logs:CreateLogStream"
                 - "logs:PutLogEvents"
               Resource: "arn:aws:logs:*:*:*"
             - Effect: Allow
               Action:
                 - "cloudwatch:PutMetricData"
               Resource: '*'

 SyntheticTestRunnerLambdaFunction:
   Type: AWS::Lambda::Function
   Properties:
     Handler: "synthetic-test-runner.handler"
     Role: !GetAtt [SyntheticTestFunctionExecutionRole, Arn]
     Code:
       S3Bucket: !Ref DemoResourcesS3BucketName
       S3Key: !Ref DemoResourcesS3ObjectKey
     Runtime: "nodejs4.3"
     Timeout: "25"
     Environment:
       Variables:
         WEBSITE_URL: !GetAtt [ElasticLoadBalancer, DNSName]
         METRIC_NAMESPACE: !FindInMap [ Constants, CloudWatchMetrics, Namespace]
         METRIC_NAME: !FindInMap [ Constants, CloudWatchMetrics, Name]

 SyntheticTestRunnerInvokePermission:
   Type: AWS::Lambda::Permission
   Properties:
     FunctionName: !GetAtt [SyntheticTestRunnerLambdaFunction, Arn]
     Action: "lambda:InvokeFunction"
     Principal: "events.amazonaws.com"
     SourceArn: !GetAtt [SyntheticTestScheduleTrigger, Arn]

 SyntheticTestScheduleTrigger:
   DependsOn: Pipeline
   Type: AWS::Events::Rule
   Properties:
     ScheduleExpression: rate(1 minute)
     State: ENABLED
     Targets:
       - Arn: !GetAtt [SyntheticTestRunnerLambdaFunction, Arn]
         Id: "InvokeSyntheticTestRunner"

 ProcessCanaryApprovalLambdaFunction:
   Type: AWS::Lambda::Function
   Properties:
     Handler: "process-canary-approval.handler"
     Role: !GetAtt [ProcessCanaryApprovalFunctionExecutionRole, Arn]
     Code:
       S3Bucket: !Ref DemoResourcesS3BucketName
       S3Key: !Ref DemoResourcesS3ObjectKey
     Runtime: "nodejs4.3"
     Timeout: "25"
     Environment:
       Variables:
         METRIC_NAMESPACE: !Ref CodeDeployApp
         DIMENSION_NAME: "DeploymentGroup"
         DIMENSION_VALUE: !Ref CanaryDeploymentGroup
         METRIC_NAME: "Request"
         SYNTHETIC_TESTS_ALARM: !Ref SyntheticTestFailureCloudWatchAlarm

 ProcessCanaryApprovalFunctionExecutionRole:
   Type: AWS::IAM::Role
   Properties:
     AssumeRolePolicyDocument:
       Statement:
       - Action: ['sts:AssumeRole']
         Effect: Allow
         Principal:
           Service: [lambda.amazonaws.com]
       Version: '2012-10-17'
     Path: /
     Policies:
       - PolicyName: CloudWatchAccess
         PolicyDocument:
           Version: '2012-10-17'
           Statement:
             - Effect: Allow
               Action:
                 - "logs:CreateLogGroup"
                 - "logs:CreateLogStream"
                 - "logs:PutLogEvents"
               Resource: "arn:aws:logs:*:*:*"
             - Effect: Allow
               Action:
                 - "codepipeline:PutApprovalResult"
               Resource:
                 - "Fn::Join": ["", ["arn:aws:codepipeline:", { "Ref" : "AWS::Region" }, ":", { "Ref" : "AWS::AccountId" }, ":", {"Ref": "Pipeline"}, "/*"]]
             - Effect: Allow
               Action:
                 - "dynamodb:Scan"
                 - "dynamodb:DeleteItem"
               Resource:
                 - "Fn::Join": ["", ["arn:aws:dynamodb:", { "Ref" : "AWS::Region" }, ":", { "Ref" : "AWS::AccountId" }, ":table/", {"Ref": "PipelineAppovalTable"}]]
             - Effect: Allow
               Action:
                 - "cloudwatch:GetMetricStatistics"
                 - "cloudwatch:DescribeAlarms"
               Resource:
                 - "*"

 ProcessCanaryApprovalInvokePermission:
   Type: AWS::Lambda::Permission
   Properties:
     FunctionName: !GetAtt [ProcessCanaryApprovalLambdaFunction, Arn]
     Action: "lambda:InvokeFunction"
     Principal: "events.amazonaws.com"
     SourceArn: !GetAtt [ProcessCanaryApprovalScheduleTrigger, Arn]

 ProcessCanaryApprovalScheduleTrigger:
     Type: AWS::Events::Rule
     Properties:
       ScheduleExpression: rate(1 minute)
       State: ENABLED
       Targets:
         - Arn: !GetAtt [ProcessCanaryApprovalLambdaFunction, Arn]
           Id: "InvokeProcessCanaryApprovals"