CI-CD-roles.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: CSYE 6225 IaC

Parameters:
  RoleName:
    Description: "Name of the IAM role for CI/CD actions"
    Type: String
    Default: "ghactions-app"
  # AWS_Region:
  #   Description: "AWS region"
  #   Type: String
  #   Default: "us-east-1"
  # AWS_ID:
  #   Description: "AWS ID"
  #   Type: String
  #   Default: "909665281672"
  
  
Resources:

  myGHCodedeployBucketPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: GH-Upload-To-S3
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          Effect: Allow
          Action:
            - s3:PutObject
            - s3:Get*
            - s3:List*
          Resource:
            - Fn::Join:
              - ""
              - - "arn:aws:s3:::"
                - "codedeploy.applicationbhan.me"
                - "/*"
            - Fn::Join:
              - ""
              - - "arn:aws:s3:::"
                - "codedeploy.applicationbhan.me"

      Users:
        - !Ref RoleName

  myGHCodedeployPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: GH-Code-deploy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - codedeploy:RegisterApplicationRevision
              - codedeploy:GetApplicationRevision
            Resource:
              - "arn:aws:codedeploy:us-east-1:909665281672:application:csye6225-webapp"

          - Effect: Allow
            Action:
              - codedeploy:CreateDeployment
              - codedeploy:GetDeployment
            Resource:
              - "*"

          - Effect: Allow
            Action:
              - codedeploy:GetDeploymentConfig
            Resource:
              - "arn:aws:codedeploy:us-east-1:909665281672:deploymentconfig:CodeDeployDefault.OneAtATime"
              - "arn:aws:codedeploy:us-east-1:909665281672:deploymentconfig:CodeDeployDefault.HalfAtATime"
              - "arn:aws:codedeploy:us-east-1:909665281672:deploymentconfig:CodeDeployDefault.AllAtOnce"
      Users:
        - !Ref RoleName

  myGHCodedeployEC2Policy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: GH-ec2-ami
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          Effect: Allow
          Action:
            -  ec2:AttachVolume
            -  ec2:AuthorizeSecurityGroupIngress
            -  ec2:CopyImage
            -  ec2:CreateImage
            -  ec2:CreateKeypair
            -  ec2:CreateSecurityGroup
            -  ec2:CreateSnapshot
            -  ec2:CreateTags
            -  ec2:CreateVolume
            -  ec2:DeleteKeyPair
            -  c2:DeleteSecurityGroup
            -  ec2:DeleteSnapshot
            -  ec2:DeleteVolume
            -  ec2:DeregisterImage
            -  ec2:DescribeImageAttribute
            -  ec2:DescribeImages
            -  ec2:DescribeInstances
            -  ec2:DescribeInstanceStatus
            -  ec2:DescribeRegions
            -  ec2:DescribeSecurityGroups
            -  ec2:DescribeSnapshots
            -  ec2:DescribeSubnets
            -  ec2:DescribeTags
            -  ec2:DescribeVolumes
            -  ec2:DetachVolume
            -  ec2:GetPasswordData
            -  ec2:ModifyImageAttribute
            -  ec2:ModifyInstanceAttribute
            -  ec2:ModifySnapshotAttribute
            -  ec2:RegisterImage
            -  ec2:RunInstances
            -  ec2:StopInstances
            -  ec2:TerminateInstances
          Resource:
            - "*"

      Users:
        - !Ref RoleName

  myGHLambdaDeploymentPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: GH-Deploy-to-Lambda
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          Effect: Allow
          Action:
            - s3:PutObject
            - iam:ListRoles
            - lambda:UpdateFunctionCode
            - lambda:CreateFunction
            - lambda:UpdateFunctionConfiguration
          Resource:
            - "arn:aws:lambda:us-east-1:909665281672:function:verification-email-service"
      Users:
        - !Ref RoleName