main.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: "Create the orchestrator setup CodePipeline - (v1.4.0)"
Parameters:
  InfrastructureName:
    Type: "String"
    Description: "A name used to differentiate this infrastructure from other existing infrastructure."
    Default: "main"
  SecondRegion:
    Type: "String"
    Description: "What is the second region this service should be deployed to?"
    AllowedValues:
    - "NONE"
    - "us-east-1"
    - "us-east-2"
    - "us-west-2"
    Default: "us-east-2"
  # CodePipeline Configuration
  ProjectName:
    Type: "String"
    Description: "The base name of the CodePipeline project (e.g. foo-bar-baz)."
  InfrastructureSuffix:
    Type: "String"
    Description: "The suffix to add to the infrastructure CodePipeline."
    Default: "infrastructure"
  SetupSuffix:
    Type: "String"
    Description: "The suffix to add to the setup CodePipeline."
    Default: "setup"
  AppBaseFolder:
    Type: "String"
    Description: "The base repository folder for the application."
    Default: "v1"
  ActionMode:
    Type: "String"
    Description: "The CodePipeline CloudFormation stack action mode."
    AllowedValues:
    - "CHANGE_SET_EXECUTE"
    - "CHANGE_SET_REPLACE"
    - "CREATE_UPDATE"
    - "DELETE_ONLY"
    - "REPLACE_ON_FAILURE"
    Default: "REPLACE_ON_FAILURE"
  LambdaActionMode:
    Type: "String"
    Description: "The CodePipeline CloudFormation stack action mode."
    AllowedValues:
    - "CHANGE_SET_EXECUTE"
    - "CHANGE_SET_REPLACE"
    - "CREATE_UPDATE"
    - "DELETE_ONLY"
    - "REPLACE_ON_FAILURE"
    Default: "REPLACE_ON_FAILURE"
  EnableCustomBuild:
    Type: "String"
    Description: "Enable custom command CodeBuild (for running any needed custom commands)."
    AllowedValues:
    - "Yes"
    - "No"
    Default: "Yes"
  UnstableEnvironment:
    Type: "String"
    Description: "The short name for the unstable (stub) environment that code is merged into."
    Default: "dev"
  InitialEnvironment:
    Type: "String"
    Description: "The short name for the first environment that code is merged into."
    Default: "int"
  QaEnvironment:
    Type: "String"
    Description: "The short name for the quality assurance environment."
    Default: "qa"
  StageEnvironment:
    Type: "String"
    Description: "The short name for the staging environment."
    Default: "stage"
  ProdEnvironment:
    Type: "String"
    Description: "The short name for the production environment."
    Default: "prod"
  # Approval Configuration
  AutomaticReject:
    Type: "String"
    Description: "Should we automatically reject a pending approval for the initial deployment CodePipeline?"
    AllowedValues:
    - "Yes"
    - "No"
    Default: "Yes"
  # CodePipeline Notification Configuration
  EnableNotifications:
    Type: "String"
    Description: "Should an e-mail SNS topic and Slack notification hook be enabled?  Please note this will only work the the Slack notifications Lambda has already been created for this region."
    AllowedValues:
    - "Yes"
    - "No"
    Default: "Yes"
  SlackNotificationLambda:
    Type: "String"
    Description: "What is the name of the function used to send out Slack notifications?"
    Default: "codepipeline-slack-notification-prod"
  # Source Configuration
  GitHubBuildAgentAccountId:
    Type: "AWS::SSM::Parameter::Value<String>"
    Description: "This is the SSM parameter containing the GitHub service account ID.  This is the ID of the GitHub account being used by the build agent (https://api.github.com/users/<your github user name>)."
    Default: "/account/main/github/service/id"
  GitHubOAuthTokenName:
    Type: "String"
    Description: "This is the name and key of the Secrets Manager secret which contains the GitHub OAuth token for source repository access."
    Default: "account/main/github:oAuthToken"
  AppGitHubOrganization:
    Type: "String"
    Description: "The GitHub organization that the repository is a part of."
    Default: "warnermedia"
  AppSourceRepository:
    Type: "String"
    Description: "What is the name of the GitHub application repository?"
  AppSourceBranch:
    Type: "String"
    Description: "What is the GitHub application repository branch?"
    Default: "main"
  AppSourceCloneDepth:
    Type: "Number"
    Description: "How shallow should the clone depth be?"
    AllowedValues:
    - 1
    - 5
    - 25
    - 0
    Default: 5
  HotfixBranchPattern:
    Type: "String"
    Description: "A branch name regular expression for hotfix branches."
    Default: ".*hotfix.*"
  UnstableBranch:
    Type: "String"
    Description: "The branch used to build the unstable/DEV environment."
    Default: "dev"
  # ZIP File Configuration
  ExternalArtifactBucket:
    Type: "String"
    Description: "An external artifact bucket that we need to push files to from the current account."
    Default: ""
  InfrastructureSourceFile:
    Type: "String"
    Description: "The name of the ZIP file for the infrastructure source."
    Default: "iac.zip"
  TestSourceFile:
    Type: "String"
    Description: "The name of the ZIP file for the test source."
    Default: "test.zip"
  LambdaSourceFile:
    Type: "String"
    Description: "The name of the ZIP file for the service source."
    Default: "lambda.zip"
  LambdaEnvSourceFile:
    Type: "String"
    Description: "The name of the ZIP file for the service environment source."
    Default: "lambda-env.zip"
  SetupSourceFile:
    Type: "String"
    Description: "The name of the ZIP file for the setup/infrastructure CodePipeline source."
    Default: "setup.zip"
  # CodeBuild Configuration
  CodeBuildSpecPath:
    Type: "String"
    Description: "The path and file name for the main BuildSpec file."
    Default: "v1/build/aws/codebuild/buildspec/orchestrator/amzn2.yaml"
  CodeBuildDeployScriptPath:
    Type: "String"
    Description: "The path and file name for the main orchestrator deployment file."
    Default: "v1/build/aws/codebuild/orchestrator/build.sh"
  CodeBuildComputeType:
    Type: "String"
    Description: "The amount of compute needed for this project (Small: 3GB/2CPU, Medium: 7GB/4CPU, Large: 15GB/8CPU, 2X Large: 145GB/72CPU)?"
    AllowedValues:
    - "BUILD_GENERAL1_SMALL"
    - "BUILD_GENERAL1_MEDIUM"
    - "BUILD_GENERAL1_LARGE"
    - "BUILD_GENERAL1_2XLARGE"
    Default: "BUILD_GENERAL1_SMALL"
  CodeBuildEnableDepInstall:
    Type: "String"
    Description: "Should the orchestrator automatically install dependencies so that the dependencies don't have to be added manually?  This can slow down the orchestrator build (depending on how many dependencies are needed by the application)."
    AllowedValues:
    - "Yes"
    - "No"
    Default: "Yes"
  CodeBuildCustomInstallCommand:
    Type: "String"
    Description: "What command should be run to install the dependencies?"
    Default: "npm install --only=prod"
  CodeBuildImage:
    Type: "String"
    Description: "Which Docker version do you want to use? For other images/runtimes, try to create a project through the interface."
    AllowedValues:
    - "aws/codebuild/amazonlinux2-x86_64-standard:1.0"
    - "aws/codebuild/amazonlinux2-x86_64-standard:2.0"
    - "aws/codebuild/amazonlinux2-x86_64-standard:3.0"
    - "aws/codebuild/standard:1.0"
    - "aws/codebuild/standard:2.0"
    - "aws/codebuild/standard:3.0"
    - "aws/codebuild/standard:4.0"
    Default: "aws/codebuild/amazonlinux2-x86_64-standard:3.0"
  CodeBuildTimeoutInMinutes:
    Type: "Number"
    Description: "How long should the build run before it times out?"
    Default: 10
  # Service Configuration
  ServiceSubdomain:
    Type: "String"
    Description: "What is the base name for the DNS entry? The environment will automatically be added to the end."
    Default: "boilerplate-lambda-nodejs"
  # Tag Configuration
  TagEnvironment:
    Type: "String"
    Description: "What is the environment tag?"
    AllowedValues:
    - "nonprod"
    - "prod"
    Default: "nonprod"
Conditions:
  AppBaseFolder: !Not [ !Equals [ !Ref AppBaseFolder, "" ] ]
  EnableNotifications: !Equals [ !Ref EnableNotifications, "Yes" ]
  UnstableEnvironment: !Not [ !Equals [ !Ref UnstableEnvironment, "NONE" ] ]
Resources:
  OrchestratorCodeBuildRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: "Allow"
          Principal:
            Service:
            - "codebuild.amazonaws.com"
          Action:
          - "sts:AssumeRole"
      Policies:
      - PolicyName: "CodeBuildServiceRole"
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Sid: "CodePipelineInteractions"
            Resource: "*"
            Effect: "Allow"
            Action:
            - "codepipeline:StartPipelineExecution"
            - "codepipeline:ListPipelines"
            - "codepipeline:GetPipelineState"
            - "codepipeline:PutApprovalResult"
          - Sid: "KmsInteractions"
            Effect: "Allow"
            Action:
            - "kms:GenerateDataKey"
            - "kms:Decrypt"
            Resource: !Sub "{{resolve:ssm:/kms/${InfrastructureName}/key/s3/arn}}"
          - Sid: "CloudWatchLogsPolicy"
            Effect: "Allow"
            Action:
            - "logs:CreateLogGroup"
            - "logs:CreateLogStream"
            - "logs:PutLogEvents"
            Resource: "*"
          - Sid: "GlobalBucketLocation"
            Effect: "Allow"
            Action:
            - "s3:GetBucketLocation"
            - "s3:ListBucketMultipartUploads"
            Resource: !Sub "{{resolve:ssm:/s3/${InfrastructureName}/bucket/artifact/arn}}"
          - Sid: "ListBucket"
            Effect: "Allow"
            Action:
            - "s3:ListBucket*"
            Resource: !Sub "{{resolve:ssm:/s3/${InfrastructureName}/bucket/artifact/arn}}"
          - Sid: "GeneralBucketInteractions"
            Effect: "Allow"
            Action:
            - "s3:AbortMultipartUpload"
            - "s3:DeleteObject"
            - "s3:GetObject"
            - "s3:GetObjectAcl"
            - "s3:PutObject"
            - "s3:PutObjectAcl"
            Resource:
            - !Sub "{{resolve:ssm:/s3/${InfrastructureName}/bucket/artifact/arn}}"
            - !Sub "{{resolve:ssm:/s3/${InfrastructureName}/bucket/artifact/arn}}/*"
          - Effect: "Allow"
            Action:
            - "kms:GenerateDataKey"
            - "kms:Decrypt"
            Resource: !Sub "{{resolve:ssm:/kms/${InfrastructureName}/key/infrastructure/arn}}"
          - Sid: "SecretsAccess"
            Effect: "Allow"
            Action:
            - "secretsmanager:GetResourcePolicy"
            - "secretsmanager:GetSecretValue"
            - "secretsmanager:DescribeSecret"
            - "secretsmanager:ListSecretVersionIds"
            Resource:
            - !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:*"
      # ManagedPolicyArns:
      # - "arn:aws:iam::aws:policy/SecretsManagerReadWrite"
      Tags:
      - Key: "Name"
        Value: !Ref "AWS::StackName"
      - Key: "application"
        Value: !Ref "AWS::StackName"
      - Key: "contact-email"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/contact-email}}"
      - Key: "customer"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/customer}}"
      - Key: "environment"
        Value: !Ref TagEnvironment
      - Key: "team"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/team}}"
  OrchestratorCodeBuildProject:
    Type: "AWS::CodeBuild::Project"
    Properties:
      Artifacts:
        Type: "NO_ARTIFACTS"
      Environment:
        ComputeType: !Ref CodeBuildComputeType
        EnvironmentVariables:
        - Name: "AUTOMATIC_REJECT"
          Value: !Ref AutomaticReject
        - Name: "APP_BASE_FOLDER"
          Value: !Ref AppBaseFolder
        - Name: "AWS_ACCOUNT_ID"
          Value: !Ref "AWS::AccountId"
        - Name: "AWS_REGION"
          Value: !Ref "AWS::Region"
        - Name: "AWS_SECOND_REGION"
          Value: !Ref SecondRegion
        - Name: "AWS_S3_BUCKET"
          Value: !Sub "{{resolve:ssm:/s3/${InfrastructureName}/bucket/artifact/name}}"
        - Name: "AWS_S3_FOLDER"
          Value: !Ref ProjectName
        - Name: "GITHUB_OAUTH_TOKEN_NAME"
          Value: !Ref GitHubOAuthTokenName
        - Name: "LAMBDA_UNSTABLE_CODEPIPELINE"
          Value: !Sub "${ProjectName}-${UnstableEnvironment}"
        - Name: "DEPLOY_SCRIPT_PATH"
          Value: !Ref CodeBuildDeployScriptPath
        - Name: "IAC_CODEPIPELINE"
          Value: !Sub "${ProjectName}-${InfrastructureSuffix}"
        - Name: "LAMBDA_INITIAL_CODEPIPELINE"
          Value: !Sub "${ProjectName}-${InitialEnvironment}"
        - Name: "ENABLE_DEP_INSTALL"
          Value: !Ref CodeBuildEnableDepInstall
        - Name: "CUSTOM_INSTALL_COMMAND"
          Value: !Ref CodeBuildCustomInstallCommand
        - Name: "ENV_ZIP_FILE"
          Value: !Ref LambdaEnvSourceFile
        - Name: "IAC_ZIP_FILE"
          Value: !Ref InfrastructureSourceFile
        - Name: "TEST_ZIP_FILE"
          Value: !Ref TestSourceFile
        - Name: "LAMBDA_ZIP_FILE"
          Value: !Ref LambdaSourceFile
        - Name: "SETUP_ZIP_FILE"
          Value: !Ref SetupSourceFile
        - Name: "SETUP_CODEPIPELINE"
          Value: !Sub "${ProjectName}-${SetupSuffix}"
        - Name: "UNSTABLE_BRANCH"
          Value: !Ref UnstableBranch
        Image: !Ref CodeBuildImage
        PrivilegedMode: true
        Type: "LINUX_CONTAINER"
      Name: !Sub "${ProjectName}-orchestrator"
      ServiceRole: !GetAtt OrchestratorCodeBuildRole.Arn
      Source:
        Auth:
          Resource: !Sub "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:token/github"
          Type: "OAUTH"
        Type: "GITHUB"
        Location: !Sub "https://github.com/${AppGitHubOrganization}/${AppSourceRepository}.git"
        BuildSpec: !Ref CodeBuildSpecPath
        GitCloneDepth: !Ref AppSourceCloneDepth
        ReportBuildStatus: true
      SourceVersion: !Ref AppSourceBranch
      # SecondarySources:
      # - Auth:
      #     Resource: !Sub "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:token/github"
      #     Type: "OAUTH"
      #   Type: "GITHUB"
      #   Location: !Sub "https://github.com/${SharedGitHubOrganization}/${SharedSourceRepository}.git"
      #   GitCloneDepth: !Ref SharedSourceCloneDepth
      #   SourceIdentifier: "SHARED_SOURCE_FILES"
      # SecondarySourceVersions:
      # - SourceIdentifier: "SHARED_SOURCE_FILES"
      #   SourceVersion: !Ref SharedSourceBranch
      Triggers:
        Webhook: true
        FilterGroups:
        - - Type: "EVENT"
            Pattern: "PUSH"
          - Type: "HEAD_REF"
            Pattern: !Sub "^refs/heads/${AppSourceBranch}$"
            ExcludeMatchedPattern: false
          - Type: "ACTOR_ACCOUNT_ID"
            Pattern: !Ref GitHubBuildAgentAccountId
            ExcludeMatchedPattern: true
        - - Type: "EVENT"
            Pattern: "PUSH"
          - Type: "HEAD_REF"
            Pattern: !If [ UnstableEnvironment, !Sub "^refs/heads/${UnstableBranch}$", "^refs/heads/disabled$" ]
            ExcludeMatchedPattern: false
          - Type: "ACTOR_ACCOUNT_ID"
            Pattern: !Ref GitHubBuildAgentAccountId
            ExcludeMatchedPattern: true
        - - Type: "EVENT"
            Pattern: "PUSH"
          - Type: "HEAD_REF"
            Pattern: !Sub "^refs/heads/${HotfixBranchPattern}"
            ExcludeMatchedPattern: false
          - Type: "ACTOR_ACCOUNT_ID"
            Pattern: !Ref GitHubBuildAgentAccountId
            ExcludeMatchedPattern: true
      TimeoutInMinutes: !Ref CodeBuildTimeoutInMinutes
      Tags:
      - Key: "Name"
        Value: !Ref "AWS::StackName"
      - Key: "application"
        Value: !Ref "AWS::StackName"
      - Key: "contact-email"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/contact-email}}"
      - Key: "customer"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/customer}}"
      - Key: "environment"
        Value: !Ref TagEnvironment
      - Key: "team"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/team}}"
  SetupCodePipelineEventsRule:
    Type: "AWS::Events::Rule"
    Condition: EnableNotifications
    Properties:
      Name: !Sub "codepipeline-${ProjectName}-${SetupSuffix}"
      Description: !Sub 'Events rule for e-mail and Slack notifications for the "${ProjectName}-${SetupSuffix}" CodePipeline.'
      State: "ENABLED"
      EventPattern:
        source:
        - "aws.codepipeline"
        detail-type: # The following targets just the main CodePipeline states, you can also target individual stages (CodePipeline Stage Execution State Change) or actions (CodePipeline Action Execution State Change)
        - "CodePipeline Pipeline Execution State Change"
        # - "CodePipeline Stage Execution State Change"
        # - "CodePipeline Action Execution State Change"
        detail:
          state: # These are the CodePipeline states: CANCELED, FAILED, RESUMED, STARTED, SUCCEEDED, and SUPERSEDED: https://docs.aws.amazon.com/codepipeline/latest/userguide/detect-state-changes-cloudwatch-events.html
          - "CANCELED"
          - "FAILED"
          - "STARTED"
          - "SUCCEEDED"
          pipeline:
          - !Sub "${ProjectName}-${SetupSuffix}"
      Targets:
      - Arn: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${SlackNotificationLambda}"
        Id: !Sub "slack-lambda-${ProjectName}-${SetupSuffix}"
  SetupServiceRole:
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: "Allow"
          Principal:
            Service:
            - "cloudformation.amazonaws.com"
            - "codepipeline.amazonaws.com"
          Action:
          - "sts:AssumeRole"
      Policies:
      - PolicyName: "SetupServiceRole"
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Effect: "Allow"
            Action:
            - "iam:AttachRolePolicy"
            - "iam:CreateRole"
            - "iam:CreateServiceLinkedRole"
            - "iam:DeleteRole"
            - "iam:DeleteRolePermissionsBoundary"
            - "iam:DeleteRolePolicy"
            - "iam:DeleteServiceLinkedRole"
            - "iam:DetachRolePolicy"
            - "iam:GetRole"
            - "iam:GetRolePolicy"
            - "iam:GetServiceLinkedRoleDeletionStatus"
            - "iam:ListAttachedRolePolicies"
            - "iam:ListInstanceProfilesForRole"
            - "iam:ListRolePolicies"
            - "iam:ListRoleTags"
            - "iam:PassRole"
            - "iam:PutRolePermissionsBoundary"
            - "iam:PutRolePolicy"
            - "iam:TagRole"
            - "iam:UntagRole"
            - "iam:UpdateAssumeRolePolicy"
            - "iam:UpdateRole"
            - "iam:UpdateRoleDescription"
            Resource: "*"
          - Effect: "Allow"
            Action:
            - "kms:GenerateDataKey"
            - "kms:Decrypt"
            Resource: !Sub "{{resolve:ssm:/kms/${InfrastructureName}/key/s3/arn}}"
      ManagedPolicyArns:
      - "arn:aws:iam::aws:policy/AWSCloudFormationFullAccess"
      - "arn:aws:iam::aws:policy/AWSCodePipeline_FullAccess"
      - "arn:aws:iam::aws:policy/AmazonS3FullAccess"
      - "arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess"
      Tags:
      - Key: "Name"
        Value: !Ref "AWS::StackName"
      - Key: "application"
        Value: !Ref "AWS::StackName"
      - Key: "contact-email"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/contact-email}}"
      - Key: "customer"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/customer}}"
      - Key: "environment"
        Value: !Ref TagEnvironment
      - Key: "team"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/team}}"
  SetupCodePipeline:
    Type: "AWS::CodePipeline::Pipeline"
    Properties:
      RoleArn: !GetAtt SetupServiceRole.Arn
      Name: !Sub "${ProjectName}-${SetupSuffix}"
      RestartExecutionOnUpdate: true
      ArtifactStores:
      - Region: "us-east-1"
        ArtifactStore:
          Type: "S3"
          Location: !Sub "{{resolve:ssm:/s3/${InfrastructureName}/bucket/codepipeline/base-name}}-us-east-1"
      - Region: "us-east-2"
        ArtifactStore:
          Type: "S3"
          Location: !Sub "{{resolve:ssm:/s3/${InfrastructureName}/bucket/codepipeline/base-name}}-us-east-2"
      - Region: "us-west-2"
        ArtifactStore:
          Type: "S3"
          Location: !Sub "{{resolve:ssm:/s3/${InfrastructureName}/bucket/codepipeline/base-name}}-us-west-2"
      Stages:
      - Name: "Source"
        Actions:
        - Name: "Setup_Templates"
          ActionTypeId:
            Category: "Source"
            Owner: "AWS"
            Provider: "S3"
            Version: "1"
          Configuration:
            S3Bucket: !Sub "{{resolve:ssm:/s3/${InfrastructureName}/bucket/artifact/name}}"
            S3ObjectKey: !Sub "${ProjectName}/base/${SetupSourceFile}"
            PollForSourceChanges: "false"
          OutputArtifacts:
          - Name: "SETUP_SOURCE_FILES"
      - Name: "Setup"
        Actions:
        - Name: "Infrastructure_CodePipeline"
          ActionTypeId:
            Category: "Deploy"
            Owner: "AWS"
            Provider: "CloudFormation"
            Version: "1"
          Configuration:
            ActionMode: "REPLACE_ON_FAILURE"
            StackName: !Sub "${InfrastructureName}-codepipeline-infrastructure-${ServiceSubdomain}-${TagEnvironment}"
            Capabilities: "CAPABILITY_NAMED_IAM,CAPABILITY_AUTO_EXPAND"
            TemplatePath:
              Fn::Sub:
              - "SETUP_SOURCE_FILES::${Folder}iac/cfn/codepipeline/infrastructure.yaml"
              - Folder: !If [ AppBaseFolder, !Sub "${AppBaseFolder}/", "" ]
            TemplateConfiguration:
              Fn::Sub:
              - "SETUP_SOURCE_FILES::${Folder}env/cfn/codepipeline/infrastructure/${TagEnvironment}.json"
              - Folder: !If [ AppBaseFolder, !Sub "${AppBaseFolder}/", "" ]
            RoleArn: !GetAtt SetupServiceRole.Arn
            OutputFileName: "stack-output.json"
            ParameterOverrides: !Sub |
              {
                "ExternalArtifactBucket": "${ExternalArtifactBucket}",
                "EnableCustomBuild": "${EnableCustomBuild}",
                "ProjectName": "${ProjectName}",
                "ServiceSubdomain": "${ServiceSubdomain}",
                "ActionMode": "${ActionMode}",
                "LambdaActionMode": "${LambdaActionMode}",
                "SecondRegion": "${SecondRegion}",
                "SlackNotificationLambda": "${SlackNotificationLambda}",
                "UnstableEnvironment": "${UnstableEnvironment}",
                "InitialEnvironment": "${InitialEnvironment}",
                "QaEnvironment": "${QaEnvironment}",
                "StageEnvironment": "${StageEnvironment}",
                "ProdEnvironment": "${ProdEnvironment}",
                "TagEnvironment": "${TagEnvironment}"
              }
          InputArtifacts:
          - Name: "SETUP_SOURCE_FILES"
          OutputArtifacts:
          - Name: "INFRASTRUCTURE_OUTPUT_PRIMARY_REGION"
          RunOrder: 1
          Region: !Ref "AWS::Region"
      Tags:
      - Key: "Name"
        Value: !Ref "AWS::StackName"
      - Key: "application"
        Value: !Ref "AWS::StackName"
      - Key: "contact-email"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/contact-email}}"
      - Key: "customer"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/customer}}"
      - Key: "environment"
        Value: !Ref TagEnvironment
      - Key: "team"
        Value: !Sub "{{resolve:ssm:/account/${InfrastructureName}/tag/team}}"
Outputs:
  OrchestratorCodeBuildRoleName:
    Description: "The name of the orchestrator CodeBuild IAM Role."
    Value: !Ref OrchestratorCodeBuildRole
    Export:
      Name: !Sub "${AWS::StackName}-OrchestratorCodeBuildRoleName"
  OrchestratorCodeBuildRoleArn:
    Description: "The ARN of the orchestrator CodeBuild IAM Role."
    Value: !GetAtt OrchestratorCodeBuildRole.Arn
    Export:
      Name: !Sub "${AWS::StackName}-OrchestratorCodeBuildRoleArn"
  OrchestratorCodeBuildRoleId:
    Description: "The ID of the orchestrator CodeBuild IAM Role."
    Value: !GetAtt OrchestratorCodeBuildRole.RoleId
    Export:
      Name: !Sub "${AWS::StackName}-OrchestratorCodeBuildRoleId"
  OrchestratorCodeBuildProjectName:
    Description: "The name of the orchestrator CodeBuild project."
    Value: !Ref OrchestratorCodeBuildProject
    Export:
      Name: !Sub "${AWS::StackName}-OrchestratorCodeBuildProjectName"
  OrchestratorCodeBuildProjectArn:
    Description: "The ARN of the orchestrator CodeBuild project."
    Value: !GetAtt OrchestratorCodeBuildProject.Arn
    Export:
      Name: !Sub "${AWS::StackName}-OrchestratorCodeBuildProjectArn"
  SetupCodePipelineEventsRuleId:
    Condition: EnableNotifications
    Description: "The ID of the setup CodePipeline events rule."
    Value: !Ref SetupCodePipelineEventsRule
    Export:
      Name: !Sub "${AWS::StackName}-SetupCodePipelineEventsRuleId"
  SetupCodePipelineEventsRuleArn:
    Condition: EnableNotifications
    Description: "The ARN of the setup CodePipeline events rule."
    Value: !GetAtt SetupCodePipelineEventsRule.Arn
    Export:
      Name: !Sub "${AWS::StackName}-SetupCodePipelineEventsRuleArn"
  SetupCodePipelineName:
    Description: "The name of the setup CodePipeline."
    Value: !Ref SetupCodePipeline
    Export:
      Name: !Sub "${AWS::StackName}-SetupCodePipelineName"
  SetupCodePipelineVersion:
    Description: "The version of the setup CodePipeline."
    Value: !GetAtt SetupCodePipeline.Version
    Export:
      Name: !Sub "${AWS::StackName}-SetupCodePipelineVersion"
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: "General Configuration"
      Parameters:
      - InfrastructureName
      - SecondRegion
    - Label:
        default: "CodePipeline Configuration"
      Parameters:
      - ProjectName
      - InfrastructureSuffix
      - SetupSuffix
      - AppBaseFolder
      - ActionMode
      - LambdaActionMode
      - EnableCustomBuild
      - UnstableEnvironment
      - InitialEnvironment
      - QaEnvironment
      - StageEnvironment
      - ProdEnvironment
    - Label:
        default: "CodePipeline Notification Configuration"
      Parameters:
      - EnableNotifications
      - SlackNotificationLambda
    - Label:
        default: "Source Configuration"
      Parameters:
      - GitHubBuildAgentAccountId
      - GitHubOAuthTokenName
      - AppGitHubOrganization
      - AppSourceRepository
      - AppSourceBranch
      - AppSourceCloneDepth
      - HotfixBranchPattern
      - UnstableBranch
    - Label:
        default: "ZIP File Configuration"
      Parameters:
      - ExternalArtifactBucket
      - InfrastructureSourceFile
      - TestSourceFile
      - LambdaSourceFile
      - LambdaEnvSourceFile
      - SetupSourceFile
    - Label:
        default: "CodeBuild Configuration"
      Parameters:
      - CodeBuildSpecPath
      - CodeBuildDeployScriptPath
      - CodeBuildComputeType
      - CodeBuildEnableDepInstall
      - CodeBuildCustomInstallCommand
      - CodeBuildImage
      - CodeBuildTimeoutInMinutes
      - AutomaticReject
    - Label:
        default: "Service Configuration"
      Parameters:
      - ServiceSubdomain
    - Label:
        default: "Tag Configuration"
      Parameters:
      - TagEnvironment
    ParameterLabels:
      # General Configuration
      InfrastructureName:
        default: "Infrastructure Name:"
      SecondRegion:
        default: "Second Region:"
      # CodePipeline Configuration
      ProjectName:
        default: "CodePipeline Project Name:"
      InfrastructureSuffix:
        default: "Infrastructure Suffix:"
      SetupSuffix:
        default: "Setup Suffix:"
      AppBaseFolder:
        default: "CodePipeline Application Base Folder:"
      ActionMode:
        default: "CodePipeline CloudFormation Action Mode:"
      LambdaActionMode:
        default: "Service CloudFormation Action Mode:"
      EnableCustomBuild:
        default: "Enable Custom Build:"
      UnstableEnvironment:
        default: "Unstable Environment"
      InitialEnvironment:
        default: "Initial Environment:"
      QaEnvironment:
        default: "QA Environment:"
      StageEnvironment:
        default: "Stage Environment:"
      ProdEnvironment:
        default: "Production Environment:"
      # CodePipeline Notification Configuration
      EnableNotifications:
        default: "Enable E-mail and Slack Notifications:"
      SlackNotificationLambda:
        default: "Slack Notification Lambda Name:"
      # Source Configuration
      GitHubBuildAgentAccountId:
        default: "GitHub Build Agent Account ID:"
      GitHubOAuthTokenName:
        default: "GitHub OAuth Token Name:"
      AppGitHubOrganization:
        default: "Application GitHub Organization:"
      AppSourceRepository:
        default: "Application GitHub Repository:"
      AppSourceBranch:
        default: "Application GitHub Branch:"
      AppSourceCloneDepth:
        default: "Application GitHub Source Clone Depth:"
      HotfixBranchPattern:
        default: "Hotfix Branch:"
      UnstableBranch:
        default: "Unstable GitHub Environment Branch:"
      # ZIP Configuration
      ExternalArtifactBucket:
        default: "External Artifact Bucket Name:"
      InfrastructureSourceFile:
        default: "Infrastructure Source ZIP File:"
      TestSourceFile:
        default: "Test Source ZIP File:"
      LambdaSourceFile:
        default: "Service Source ZIP File:"
      LambdaEnvSourceFile:
        default: "Service Environment Source ZIP File:"
      SetupSourceFile:
        default: "Setup Source ZIP File:"
      # CodeBuild Configuration
      CodeBuildSpecPath:
        default: "CodeBuild Main BuildSpec Path:"
      CodeBuildDeployScriptPath:
        default: "CodeBuild Deploy Script Path:"
      CodeBuildComputeType:
        default: "CodeBuild Compute Type:"
      CodeBuildEnableDepInstall:
        default: "CodeBuild Enable Dependency Install:"
      CodeBuildCustomInstallCommand:
        default: "CodeBuild Custom Install Command:"
      CodeBuildImage:
        default: "CodeBuild Docker Image:"
      CodeBuildTimeoutInMinutes:
        default: "CodeBuild Timeout (in Minutes):"
      AutomaticReject:
        default: "Automatically Reject:"
      # Service Configuration
      ServiceSubdomain:
        default: "Service Subdomain:"
      # Tag Configuration
      TagEnvironment:
        default: "Environment:"