Skip to content

Commit ed427da

Browse files
lalver1lalver1
authored
Feat: CloudFormation templates for resources not managed by Copilot (#145)
2 parents 4e0c655 + 6942543 commit ed427da

File tree

4 files changed

+205
-1
lines changed

4 files changed

+205
-1
lines changed

‎.devcontainer/devcontainer.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
"DavidAnson.vscode-markdownlint",
2626
"eamodio.gitlens",
2727
"esbenp.prettier-vscode",
28+
"kddejong.vscode-cfn-lint",
2829
"mhutchie.git-graph",
2930
"monosans.djlint",
3031
"ms-python.python",

‎infra/cloudformation/gh_actions.yml

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# CloudFormation template for GitHub Actions OIDC Identity Provider and IAM Role.
2+
# This template creates an IAM OIDC Identity Provider and an IAM Role that allows
3+
# GitHub Actions to securely authenticate with the PeMS AWS account.
4+
5+
AWSTemplateFormatVersion: "2010-09-09"
6+
Description: >
7+
CloudFormation template to create an IAM OIDC Identity Provider and
8+
IAM Role for GitHub Actions
9+
10+
Parameters:
11+
GitHubOrgRepo:
12+
Description: Name of GitHub organization and repository (e.g., "my-org/my-repo")
13+
Type: String
14+
15+
Thumbprint:
16+
Description: The thumbprint of the GitHub Actions OIDC provider's root CA certificate
17+
Type: String
18+
Default: d89e3bd43d5d909b47a18977aa9d5ce36cee184c
19+
20+
Resources:
21+
GitHubOIDCProvider:
22+
Type: "AWS::IAM::OIDCProvider"
23+
DeletionPolicy: Delete
24+
Properties:
25+
ClientIdList:
26+
- "sts.amazonaws.com"
27+
ThumbprintList:
28+
- !Ref Thumbprint
29+
Url: "https://token.actions.githubusercontent.com"
30+
31+
# This IAM Role is assumed by GitHub Actions workflows
32+
GitHubActionsRole:
33+
Type: "AWS::IAM::Role"
34+
DeletionPolicy: Delete
35+
Properties:
36+
RoleName: "pems-github-actions"
37+
Description: Assume and perform GitHub Actions in pems repo of the compilerla GitHub organization
38+
AssumeRolePolicyDocument:
39+
Version: "2012-10-17"
40+
Statement:
41+
- Effect: "Allow"
42+
Principal:
43+
# The ARN of the OIDC provider is used as the Federated principal.
44+
Federated: !Ref GitHubOIDCProvider
45+
Action: "sts:AssumeRoleWithWebIdentity"
46+
Condition:
47+
StringEquals:
48+
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
49+
StringLike:
50+
"token.actions.githubusercontent.com:sub": !Sub "repo:${GitHubOrgRepo}:*"
51+
Policies:
52+
- PolicyName: GitHubActionsPolicy
53+
PolicyDocument:
54+
Version: "2012-10-17"
55+
Statement:
56+
- Sid: GetSSMParameterAll
57+
Effect: Allow
58+
Action: "ssm:GetParameter"
59+
Resource: "arn:aws:ssm:us-west-2:715841364638:parameter/copilot/applications/pems/*"
60+
- Sid: GetSSMParameter
61+
Effect: Allow
62+
Action: "ssm:GetParameter"
63+
Resource: "arn:aws:ssm:us-west-2:715841364638:parameter/copilot/applications/pems"
64+
- Sid: GetSSMParameterByPath
65+
Effect: Allow
66+
Action: "ssm:GetParametersByPath"
67+
Resource: "arn:aws:ssm:us-west-2:715841364638:parameter/copilot/applications/pems/components/"
68+
- Sid: AssumeRole
69+
Effect: Allow
70+
Action: "sts:AssumeRole"
71+
Resource: "arn:aws:iam::715841364638:role/pems-dev-EnvManagerRole"
72+
- Sid: ListStackInstances
73+
Effect: Allow
74+
Action: "cloudformation:ListStackInstances"
75+
Resource: "arn:aws:cloudformation:us-west-2:715841364638:stackset/pems-infrastructure:ecefc290-0f7f-470a-8b9e-b6a39adf65b7"
76+
- Sid: DescribeStacks
77+
Effect: Allow
78+
Action: "cloudformation:DescribeStacks"
79+
Resource: "arn:aws:cloudformation:us-west-2:715841364638:stack/StackSet-pems-infrastructure-c95edbbc-22a7-4239-a10b-7d73ba9344c4/45d26e70-31d1-11f0-a04a-0a0876def005"
80+
- Sid: GetAuthorizationToken
81+
Effect: Allow
82+
Action: "ecr:GetAuthorizationToken"
83+
Resource: "*"
84+
- Sid: "ECRImagePush"
85+
Effect: "Allow"
86+
Action:
87+
- "ecr:InitiateLayerUpload"
88+
- "ecr:UploadLayerPart"
89+
- "ecr:CompleteLayerUpload"
90+
- "ecr:PutImage"
91+
- "ecr:BatchCheckLayerAvailability"
92+
- "ecr:GetDownloadUrlForLayer"
93+
- "ecr:GetRepositoryPolicy"
94+
- "ecr:DescribeRepositories"
95+
- "ecr:ListImages"
96+
- "ecr:DescribeImages"
97+
- "ecr:BatchGetImage"
98+
- "ecr:GetLifecyclePolicy"
99+
- "ecr:GetLifecyclePolicyPreview"
100+
- "ecr:ListTagsForResource"
101+
- "ecr:DescribeImageScanFindings"
102+
Resource: "arn:aws:ecr:us-west-2:715841364638:repository/pems/*"
103+
104+
Outputs:
105+
OIDCProviderArn:
106+
Description: The ARN of the created OIDC Provider
107+
Value: !Ref GitHubOIDCProvider
108+
GitHubActionsRoleArn:
109+
Description: The ARN of the IAM Role for GitHub Actions
110+
Value: !GetAtt GitHubActionsRole.Arn

‎infra/cloudformation/parameter_store.yml

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# CloudFormation template for creating SSM Parameters that are not managed
2+
# by AWS Copilot.
3+
4+
AWSTemplateFormatVersion: "2010-09-09"
5+
Description: CloudFormation template to create various parameters in AWS SSM Parameter Store
6+
7+
Parameters:
8+
DjangoAllowedHosts:
9+
Type: CommaDelimitedList
10+
Description: A comma-separated list of host/domain names that a Django application is permitted to serve
11+
Default: "*"
12+
DjangoDBFixtures:
13+
Type: String
14+
Description: Name of Django database fixtures json file
15+
Default: "fixtures.json"
16+
DjangoDBName:
17+
Type: String
18+
Description: Name of Django database
19+
Default: "django"
20+
DjangoDBUser:
21+
Type: String
22+
Description: Name of user for Django database
23+
Default: "django"
24+
DjangoDBPassword:
25+
Type: String
26+
Description: Password of user for Django database
27+
Default: "django_password"
28+
29+
Resources:
30+
DjangoAllowedHostsParameter:
31+
Type: "AWS::SSM::Parameter"
32+
DeletionPolicy: Delete
33+
Properties:
34+
Name: /pems/web/DJANGO_ALLOWED_HOSTS
35+
Description: Django security setting that defines a list of host/domain names that a Django application is permitted to serve
36+
Type: StringList
37+
Value: !Join [",", !Ref DjangoAllowedHosts]
38+
DjangoDBFixturesParameter:
39+
Type: "AWS::SSM::Parameter"
40+
DeletionPolicy: Delete
41+
Properties:
42+
Name: /pems/web/DJANGO_DB_FIXTURES
43+
Description: Name of Django database fixtures json file
44+
Type: String
45+
Value: !Ref DjangoDBFixtures
46+
DjangoDBNameParameter:
47+
Type: "AWS::SSM::Parameter"
48+
DeletionPolicy: Delete
49+
Properties:
50+
Name: /pems/web/DJANGO_DB_NAME
51+
Description: Name of Django database
52+
Type: String
53+
Value: !Ref DjangoDBName
54+
DjangoDBUserParameter:
55+
Type: "AWS::SSM::Parameter"
56+
DeletionPolicy: Delete
57+
Properties:
58+
Name: /pems/web/DJANGO_DB_USER
59+
Description: Name of user for Django database
60+
Type: String
61+
Value: !Ref DjangoDBUser
62+
DjangoDBPasswordParameter:
63+
Type: "AWS::SSM::Parameter"
64+
DeletionPolicy: Delete
65+
Properties:
66+
Name: /pems/web/DJANGO_DB_PASSWORD
67+
Description: Password of user for Django database
68+
Type: String
69+
Value: !Ref DjangoDBPassword
70+
71+
Outputs:
72+
DjangoAllowedHostsParameterName:
73+
Description: Name of the DJANGO_ALLOWED_HOSTS SSM Parameter
74+
Value: !Ref DjangoAllowedHostsParameter
75+
DjangoDBFixturesParameterName:
76+
Description: Name of the DJANGO_DB_FIXTURES SSM Parameter
77+
Value: !Ref DjangoDBFixturesParameter
78+
DjangoDBNameParameterName:
79+
Description: Name of the DJANGO_DB_NAME SSM Parameter
80+
Value: !Ref DjangoDBNameParameter
81+
DjangoDBUserParameterName:
82+
Description: Name of the DJANGO_DB_USER SSM Parameter
83+
Value: !Ref DjangoDBUserParameter
84+
DjangoDBPasswordParameterName:
85+
Description: Name of the DJANGO_DB_PASSWORD SSM Parameter
86+
Value: !Ref DjangoDBPasswordParameter

‎pyproject.toml

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,14 @@ dependencies = [
1414
]
1515

1616
[project.optional-dependencies]
17-
dev = ["black", "djlint", "flake8", "pre-commit", "setuptools_scm>=8"]
17+
dev = [
18+
"black",
19+
"cfn-lint",
20+
"djlint",
21+
"flake8",
22+
"pre-commit",
23+
"setuptools_scm>=8",
24+
]
1825

1926
test = ["coverage", "pytest", "pytest-django", "pytest-mock", "pytest-socket"]
2027

0 commit comments

Comments
 (0)