-
Notifications
You must be signed in to change notification settings - Fork 1
/
template.yaml
73 lines (69 loc) · 2.12 KB
/
template.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
Parameters:
BucketName:
Type: String
Description: The bucket's name which will contain all the project's files.
AmiId:
Type: String
Description: The AMI ID on which the compliance checks will run on (must be a RHEL-based AMI).
GitHubRepository:
Type: String
Description: The name of the GitHub repository hosting the buildspec file.
ScapGitHubRepository:
Type: String
Description: The name of the GitHub repository hosting the SCAP content.
BranchName:
Type: String
Resources:
EC2Role:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service:
- ec2.amazonaws.com
Action:
- sts:AssumeRole
Policies:
- PolicyName: S3
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- s3:GetObject
- s3:PutObject
- s3:HeadObject
Resource:
Fn::Sub:
- arn:aws:s3:::${Bucket}/*
- Bucket: !Ref BucketName
InstanceProfile:
Type: AWS::IAM::InstanceProfile
Properties:
Roles:
- !Ref EC2Role
CodeBuildStack:
Type: AWS::CloudFormation::Stack
Properties:
TemplateURL: ./cloudformation/codebuild.yaml
Parameters:
BucketName: !Ref BucketName
InstanceProfile: !Ref InstanceProfile
CodePipelineStack:
Type: AWS::CloudFormation::Stack
Properties:
TemplateURL: ./cloudformation/codepipeline.yaml
Parameters:
BucketName: !Ref BucketName
CodeBuildProjectArn:
Fn::GetAtt: [CodeBuildStack, Outputs.CodeBuildProjectArn]
CodeBuildProjectName:
Fn::GetAtt: [CodeBuildStack, Outputs.CodeBuildProjectName]
GitHubRepository: !Ref GitHubRepository
ScapGitHubRepository: !Ref ScapGitHubRepository
BranchName: !Ref BranchName
InstanceProfile: !Ref InstanceProfile
AmiId: !Ref AmiId