Working template for Cross Accounts roles

Working template for Shared CMK
Working template for Shared buckets
Working template for CI pipeline with KMS encryption
Working template for ECR repos

Author: John Preston

.gitignore

@@ -9,6 +9,9 @@ __pycache__/
 #EMACS TMP
 *~
 
+*.params.json
+
+
 OUTPUTS
 outputs/*.json
 outputs/*.yml

cicd-pipeline-ecs-composex/cfn-templates/README.rst

@@ -0,0 +1,74 @@
+CICD Pipeline blog templates
+============================
+
+If you haven't read the `blog article <https://blog.ecs-composex.lambda-my-aws.io>`_ yet, have a look to get more context
+around the following templates.
+
+Otherwise, these templates can generally be re-used in order to build simple CI pipelines for your applications and a
+multi-accounts deployment pipeline, driven by CodePipeline, across multiple accounts.
+
+If you intend to follow the structure of the pipeline and its accounts, create the stacks in the right order and right account.
+
+
+.. note::
+
+    To make things super easy, I am exporting into SSM Parameters the output of shared resources created in the account
+    where the pipeline lives.
+
+ecr_repos.yml
+-------------
+
+Template for the ECR repositories, allows the dev and shared accounts IAM profiles to perform ecr: actions against it.
+
+
+shared-kms-cmk.yml
+--------------------
+
+This template creates
+
+* KMS CMK to encrypt/decrypt artifacts in S3.
+
+We need to create it first to have the Key ID (aliases are not always very functional in IAM policies for encrypt/decrypt.
+
+.. note::
+
+    This is not mandatory. You could run codepipeline and have your artifacts stored in S3 without any specific encryption
+    but default object encryption (using AES-256 for example).
+
+.. warning::
+
+    Refer to the `KMS API reference page`_ for supported definition in IAM policies based on actions. This will save
+    you a lot of pain troubleshooting your IAM policies. Trust me ...
+
+As the output, we are only going to use the Key ARN
+
+shared-buckets.yml
+-------------------
+
+Creates one bucket for the artifacts generated by CodePipeline/Codebuild and a bucket to store the CloudFormation templates to.
+It by default does not create the bucket policies as the bucket policies are trying to evaluate that the IAM principals do exist
+prior to creating the bucket.
+
+Once we have the information we need, we will update the stack parameters accordingly and it will create the bucket policies.
+
+
+crossaccounts-roles.yml
+-----------------------
+
+This template creates 2 Roles:
+
+* A Role for CloudFormation to create the resources of the stack.
+    PowerUserAccess is plenty with procurement for IAM roles creation.
+
+* A Role for CodePipeline in the Shared/Central account to assume.
+    Provides permissions to RW objects into the shared bucket and to decrypt/encrypt objects with a KMS CMK for artifacts.
+
+The outputs are the ARN and RoleID of these two roles. We are going to use the RoleId in the shared.
+
+.. note::
+
+    Using RoleIds makes sure that these will be correctly formatted in the Bucket policy.
+
+
+
+.. _KMS API reference page: https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html

cicd-pipeline-ecs-composex/cfn-templates/app01-params.json

@@ -1,8 +1,4 @@
 [
-  {
-    "ParameterKey": "ArtifactsBucketName",
-    "ParameterValue": "codepipeline-eu-west-1-637670497245"
-  },
   {
     "ParameterKey": "DockerComposeRepoName",
     "ParameterValue": "myapps-compose"