copilot-cli/templates/app/app.yml at 238fd708679d4534b2f4c58cc3b7a85e6e1a768d · aws/copilot-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
# Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0
AWSTemplateFormatVersion: 2010-09-09
Description: Configure the AWSCloudFormationStackSetAdministrationRole to enable use of AWS CloudFormation StackSets.
Parameters:
  AdminRoleName:
    Type: String
  ExecutionRoleName:
    Type: String
  DNSDelegationRoleName:
    Type: String
    Default: ""
  AppDNSDelegatedAccounts:
    Type: CommaDelimitedList
    Default: ""
  AppDomainName:
    Type: String
    Default: ""
  AppName:
    Type: String
Conditions:
  DelegateDNS:
    !Not [!Equals [ !Ref AppDomainName, "" ]]

Resources:
  AdministrationRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref AdminRoleName
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: AssumeRole-AWSCloudFormationStackSetExecutionRole
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource:
                  - !Sub 'arn:aws:iam::*:role/${AdminRoleName}'
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref ExecutionRoleName
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !GetAtt AdministrationRole.Arn
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
      - PolicyName: ExecutionRolePolicy
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
              - Sid: StackSetRequiredPermissions
                Effect: Allow
                Action:
                  - cloudformation:*
                  - s3:*
                  - sns:*
                Resource: "*"
              - Sid: ManageKMSKeys
                Effect: Allow
                Action:
                  - kms:*
                Resource: "*"
              - Sid: ManageECRRepos
                Effect: Allow
                Action:
                  - ecr:DescribeImageScanFindings
                  - ecr:GetLifecyclePolicyPreview
                  - ecr:CreateRepository
                  - ecr:GetDownloadUrlForLayer
                  - ecr:GetAuthorizationToken
                  - ecr:ListTagsForResource
                  - ecr:ListImages
                  - ecr:DeleteLifecyclePolicy
                  - ecr:DeleteRepository
                  - ecr:SetRepositoryPolicy
                  - ecr:BatchGetImage
                  - ecr:DescribeImages
                  - ecr:DescribeRepositories
                  - ecr:BatchCheckLayerAvailability
                  - ecr:GetRepositoryPolicy
                  - ecr:GetLifecyclePolicy
                  - ecr:TagResource
                Resource: "*"

  DNSDelegationRole:
    Type: AWS::IAM::Role
    Condition: DelegateDNS
    Properties:
      RoleName: !Ref DNSDelegationRoleName
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS:  !Sub arn:aws:iam::${AWS::AccountId}:root
            Action:
              - sts:AssumeRole
          - Effect: Allow
            Principal:
              AWS: !Split
                - ','
                - !Sub
                    - 'arn:aws:iam::${inner}:root'
                    - inner: !Join
                      - ':root,arn:aws:iam::'
                      - Ref: "AppDNSDelegatedAccounts"
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
      - PolicyName: DNSDelegationPolicy
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
              - Sid: HostedZoneReadRecords
                Effect: Allow
                Action:
                  - route53:Get*
                  - route53:List*
                Resource: "*"
              - Sid: HostedZoneUpdate
                Effect: Allow
                Action:
                  - route53:ChangeResourceRecordSets
                Resource:
                  - !Sub arn:${AWS::Partition}:route53:::hostedzone/${AppHostedZone}

  AppHostedZone:
    Type: AWS::Route53::HostedZone
    Condition: DelegateDNS
    Properties:
      HostedZoneConfig:
        Comment: !Sub "Hosted zone for copilot application ${AppName}: ${AppName}.${AppDomainName}"
      Name: !Sub ${AppName}.${AppDomainName}

  AppDomainDelegationRecordSet:
    Type: AWS::Route53::RecordSet
    Condition: DelegateDNS
    Properties:
      HostedZoneName: !Sub ${AppDomainName}.
      Comment: !Sub "Record for copilot domain delegation for application ${AppDomainName}"
      Name: !Sub ${AppName}.${AppDomainName}.
      Type: NS
      TTL: '900'
      ResourceRecords: !GetAtt AppHostedZone.NameServers

Outputs:
  ExecutionRoleARN:
    Description: ExecutionRole used by this application to set up ECR Repos, KMS Keys and S3 buckets
    Value: !GetAtt ExecutionRole.Arn
  AdministrationRoleARN:
    Description: AdministrationRole used by this application to manage this application's StackSet
    Value: !GetAtt AdministrationRole.Arn