/
cicd.yaml
155 lines (150 loc) · 5.29 KB
/
cicd.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
AWSTemplateFormatVersion: "2010-09-09"
Description: >
Continuous Deployment settings for holidays in Japan
Resources:
# Permission Boundary for Roles
DeploymentPolicy:
Type: AWS::IAM::ManagedPolicy
Properties:
Description: Permission Boundary for holidays-jp Roles
ManagedPolicyName: !Sub "holidays-jp-permission-boundary-${AWS::Region}"
PolicyDocument:
Version: "2012-10-17"
Statement:
- Sid: ServiceBoundaries
Effect: Allow
Action:
- "logs:*"
- "ssm:*"
Resource: "*"
# CloudFormation Service Role for deploying SAM templates
DeploymentRole:
Type: AWS::IAM::Role
Properties:
RoleName: !Sub "holidays-jp-cfn-service-role-${AWS::Region}"
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Service:
- cloudformation.amazonaws.com
Action:
- "sts:AssumeRole"
Policies:
- PolicyName: deploy-sam-templates
PolicyDocument:
Version: "2012-10-17"
Statement:
- Sid: CreateOrChangeOnlyWithBoundary
Effect: Allow
Action:
- "iam:CreateRole"
- "iam:PutRolePolicy"
- "iam:AttachRolePolicy"
- "iam:DetachRolePolicy"
- "iam:DeleteRolePolicy"
- "iam:PutRolePermissionsBoundary"
Resource: "*"
Condition:
StringEquals:
"iam:PermissionsBoundary": !Ref DeploymentPolicy
- Sid: NoBoundaryPolicyEdit
Effect: Deny
Action:
- "iam:CreatePolicyVersion"
- "iam:DeletePolicy"
- "iam:DeletePolicyVersion"
- "iam:SetDefaultPolicyVersion"
Resource:
- !Ref DeploymentPolicy
- Sid: NoBoundaryRoleDelete
Effect: Deny
Action:
- "iam:DeleteRolePermissionsBoundary"
Resource: "*"
- Sid: OtherIAMTasks
Effect: Allow
Resource: "*"
Action:
# handle IAM Roles
- "iam:ListRolePolicies"
- "iam:ListRoleTags"
- "iam:ListRoles"
- "iam:GetRole"
- "iam:GetRolePolicy"
- "iam:ListAttachedRolePolicies"
- "iam:UpdateRole"
- "iam:UpdateRoleDescription"
- "iam:UpdateAssumeRolePolicy"
- "iam:TagRole"
- "iam:UntagRole"
- "iam:DeleteRole"
# handle Service Linked Roles
- "iam:ListPoliciesGrantingServiceAccess"
- "iam:CreateServiceLinkedRole"
- "iam:DeleteServiceLinkedRole"
- "iam:GetServiceLinkedRoleDeletionStatus"
- Sid: CloudFormationStackOperation
Effect: Allow
Action:
- "cloudformation:*"
- "lambda:*"
- "route53:*"
- "acm:*"
- "apigateway:*"
- "s3:*"
- "events:*"
Resource:
- "*"
# for GitHub Actions
GitHubActionsRole:
Type: AWS::IAM::Role
Properties:
RoleName: !Sub "holidays-jp-github-actions-${AWS::Region}"
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
AWS: arn:aws:iam::053160724612:root
Action: "sts:AssumeRole"
Condition:
StringEquals:
"sts:ExternalId": "R_kgDOF1U3OQ"
StringLike:
"aws:RequestTag/Audience": "*"
"aws:RequestTag/Environment": "production"
- Effect: Allow
Principal:
AWS: arn:aws:iam::053160724612:root
Action: "sts:TagSession"
Policies:
- PolicyName: SAMDeployment
PolicyDocument:
Version: "2012-10-17"
Statement:
- Sid: CloudFormationOperation
Effect: Allow
Action:
- "iam:PassRole"
Resource: !GetAtt DeploymentRole.Arn
- Sid: CloudFormationStackOperation
Effect: Allow
Action:
- "cloudformation:*"
Resource:
- !Sub "arn:aws:cloudformation:ap-northeast-1:${AWS::AccountId}:stack/holidays-jp/*"
- !Sub "arn:aws:cloudformation:us-east-1:${AWS::AccountId}:stack/holidays-jp-update-trigger/*"
- Sid: S3Operation
Effect: Allow
Action:
- "s3:*"
Resource:
- "arn:aws:s3:::aws-sam-cli-managed-default-samclisourcebucket-*/*"
- Sid: S3GetOperation
Effect: Allow
Action:
- "s3:ListBucket"
Resource:
- "arn:aws:s3:::aws-sam-cli-managed-default-samclisourcebucket-*"