Skip to content
This repository was archived by the owner on Nov 4, 2022. It is now read-only.

Commit c345ede

Browse files
ferdinglerferdingler
committed
Some progress in cross account deployments
1 parent fcc1218 commit c345ede

File tree

8 files changed

+628
-8
lines changed

8 files changed

+628
-8
lines changed

‎workshop/content/buildpipe/pipeline/launch/_index.en.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ date = 2020-01-03T19:29:29-08:00
44
weight = 5
55
+++
66

7-
Open the [AWS CloudFormation console]((https://console.aws.amazon.com/cloudformation/home#/stacks/new?stackName=sam-app-ci-cd)) to launch a new stack and upload the downloaded template by choosing the _Upload a template_ file option.
7+
Open the [AWS CloudFormation console](https://console.aws.amazon.com/cloudformation/home#/stacks/new?stackName=sam-app-ci-cd) to launch a new stack and upload the downloaded template by choosing the _Upload a template_ file option.
88

99
![PipelineConfiguration](/images/screenshot-pipeline-cfn-1.png)
1010

‎workshop/content/crossaccount/artifactstore/_index.en.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
+++
2+
title = "Creating a KMS Key"
3+
date = 2019-11-11T14:46:02-08:00
4+
weight = 30
5+
+++
6+
7+
The first thing we are going to do is modify the pipeline [created on Chapter 4](/buildpipe/pipeline.html), to use a symmetric Customer Master Key (CMK) to encrypt artifacts in the bucket. The easiest way to do this is by adding the following CloudFormation snippet at the end of our `pipeline.yml` file:
8+
9+
```
10+
KMSKey:
11+
Type: AWS::KMS::Key
12+
Properties:
13+
Description: Used to encrypt artifacts by CodePipeline
14+
EnableKeyRotation: true
15+
KeyPolicy:
16+
Version: "2012-10-17"
17+
Id: !Ref AWS::StackName
18+
Statement:
19+
-
20+
Effect: Allow
21+
Principal:
22+
AWS: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
23+
Action:
24+
- "kms:Create*"
25+
- "kms:Describe*"
26+
- "kms:Enable*"
27+
- "kms:List*"
28+
- "kms:Put*"
29+
- "kms:Update*"
30+
- "kms:Revoke*"
31+
- "kms:Disable*"
32+
- "kms:Get*"
33+
- "kms:Delete*"
34+
- "kms:ScheduleKeyDeletion"
35+
- "kms:CancelKeyDeletion"
36+
Resource: "*"
37+
-
38+
Effect: Allow
39+
Principal:
40+
AWS:
41+
- !GetAtt BuildProjectRole.Arn
42+
Action:
43+
- kms:Encrypt
44+
- kms:Decrypt
45+
- kms:ReEncrypt*
46+
- kms:GenerateDataKey*
47+
- kms:DescribeKey
48+
Resource: "*"
49+
50+
KMSAlias:
51+
Type: AWS::KMS::Alias
52+
Properties:
53+
AliasName: !Sub alias/codepipeline-sam-app
54+
TargetKeyId: !Ref KMSKey
55+
```
56+
57+
**(Optional)** Or if you prefer, just download the following file that already includes the snippet above.
58+
59+
```
60+
wget https://cicd.serverlessworkshops.io/assets/chapter6/step1/pipeline.yml
61+
```
62+
63+
### Update the pipeline using CloudFormation
64+
65+
Unlike previous chapters, where we were using the CloudFormation Console to launch and update stacks, this time we will update our stack using the AWS CLI as we will be doing it multiple times and is much easier to run a command than navigating a user interface over and over.
66+
67+
Run the following command on your terminal, it assumes that your CloudFormation stack for the pipeline is named `sam-app-cicd`.
68+
69+
```
70+
aws cloudformation deploy \
71+
--template-file pipeline.yml \
72+
--stack-name sam-app-cicd
73+
```

‎workshop/content/crossaccount/howitworks/_index.en.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,12 @@ The diagram above illustrates what happens when CodePipeline begins a deployment
1414

1515
#### Why encrypt the artifacts?
1616

17-
AWS CodePipeline *always* stores artifacts on S3 with encryption enabled and there is no way to disable it. The default behavior is to use the AWS Managed Key to encrypt them, but this approach doesn't work for granting access to S3 buckets across accounts. Therefore you [3] must create a KMS Customer Managed Key and then give the IAM role in the Production account permissions to use it to decrypt the artifacts.
17+
AWS CodePipeline *always* stores artifacts on S3 with encryption enabled and there is no way to disable it. The default behavior is to use the AWS Managed Key to encrypt them, but this approach doesn't work for granting access to S3 buckets across accounts. Therefore you [3] must create a KMS Customer Master Key and then give the IAM role in the Production account permissions to use it to decrypt the artifacts.
1818

1919
#### Additional reading
2020

2121
If you want to dive deeper into the concepts of Cross Account permissions in regards to Code Pipeline, here are a couple of good reads that might help you understand it better:
2222

23-
[1] https://aws.amazon.com/blogs/devops/aws-building-a-secure-cross-account-continuous-delivery-pipeline
24-
[2] https://docs.aws.amazon.com/codepipeline/latest/userguide/pipelines-create-cross-account.html
25-
[3] https://aws.amazon.com/premiumsupport/knowledge-center/cross-account-access-denied-error-s3
23+
[1] [Building a Secure Cross Account Pipeline](https://aws.amazon.com/blogs/devops/aws-building-a-secure-cross-account-continuous-delivery-pipeline)
24+
[2] [AWS Code Pipeline Cross Account Docs](https://docs.aws.amazon.com/codepipeline/latest/userguide/pipelines-create-cross-account.html)
25+
[3] [Cross Account Permissions with S3 Buckets](https://aws.amazon.com/premiumsupport/knowledge-center/cross-account-access-denied-error-s3)

‎workshop/content/crossaccount/intro/_index.en.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,4 @@ The following diagram illustrates a simple account setup that many customers sta
1212

1313
![EnvironmentSeparation](/images/environment-separation.png)
1414

15-
As you can tell from the diagram, the Dev account hosts the Code Pipeline, Artifacts Bucket and the Code Repository. The CodePipeline then deploys across the Production account using an [assumed role](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html).
16-
15+
As you can tell from the diagram, the Dev account hosts the Code Pipeline, Artifacts Bucket and the Code Repository. The CodePipeline then deploys across the Production account using an [assumed role](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html).

‎workshop/content/crossaccount/prodprep/_index.en.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
+++
22
title = "Prepare Prod account"
33
date = 2019-11-11T14:46:02-08:00
4-
weight = 25
4+
weight = 35
55
+++
66

7+
As seen in the previous diagram, there are a few resources we need to create in the Production account.

‎workshop/static/assets/chapter6/artifacts-store.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: S3 bucket for CodePipeline artifacts store with KMS Customer Managed Key
3+
Parameters:
4+
ProdAccountNumber:
5+
Description: 12-digit AWS account number for production
6+
Type: Number
7+
8+
Resources:
9+
KMSKey:
10+
Type: AWS::KMS::Key
11+
Properties:
12+
Description: Used to encrypt artifacts by CodePipeline
13+
EnableKeyRotation: true
14+
KeyPolicy:
15+
Version: "2012-10-17"
16+
Id: !Ref AWS::StackName
17+
Statement:
18+
-
19+
Effect: Allow
20+
Principal:
21+
AWS: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
22+
Action:
23+
- "kms:Create*"
24+
- "kms:Describe*"
25+
- "kms:Enable*"
26+
- "kms:List*"
27+
- "kms:Put*"
28+
- "kms:Update*"
29+
- "kms:Revoke*"
30+
- "kms:Disable*"
31+
- "kms:Get*"
32+
- "kms:Delete*"
33+
- "kms:ScheduleKeyDeletion"
34+
- "kms:CancelKeyDeletion"
35+
Resource: "*"
36+
-
37+
Effect: Allow
38+
Principal:
39+
AWS:
40+
- !Sub arn:aws:iam::${ProdAccountNumber}:root
41+
- !Sub arn:aws:iam::485020055381:role/service-role/codebuild-sam-app-build-service-role
42+
Action:
43+
- kms:Encrypt
44+
- kms:Decrypt
45+
- kms:ReEncrypt*
46+
- kms:GenerateDataKey*
47+
- kms:DescribeKey
48+
Resource: "*"
49+
50+
KMSAlias:
51+
Type: AWS::KMS::Alias
52+
Properties:
53+
AliasName: !Sub alias/codepipeline-crossaccounts
54+
TargetKeyId: !Ref KMSKey
55+
56+
# ArtifactsBucket:
57+
# Type: AWS::S3::Bucket
58+
# DeletionPolicy: Retain
59+
60+
Outputs:
61+
CMK:
62+
Value: !GetAtt [KMSKey, Arn]
63+
# ArtifactsBucket:
64+
# Value: !Ref ArtifactsBucket

‎workshop/static/assets/chapter6/prod-roles.yml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: Resources needed for CodePipeline to deploy across accounts
3+
Parameters:
4+
ArtifactsBucket:
5+
Description: S3 Bucket that holds the pipeline artifacts
6+
Type: String
7+
ToolsAccount:
8+
Description: AWS AccountNumber for Tools
9+
Type: Number
10+
CMKARN:
11+
Description: ARN of the KMS CMK creates in Tools account
12+
Type: String
13+
Resources:
14+
CFRole:
15+
Type: AWS::IAM::Role
16+
Properties:
17+
RoleName: !Sub ToolsAcctCodePipelineCloudFormationRole
18+
AssumeRolePolicyDocument:
19+
Version: 2012-10-17
20+
Statement:
21+
-
22+
Effect: Allow
23+
Principal:
24+
AWS:
25+
- !Ref ToolsAccount
26+
Action:
27+
- sts:AssumeRole
28+
Path: /
29+
CFPolicy:
30+
Type: AWS::IAM::Policy
31+
Properties:
32+
PolicyName: !Sub ToolsAcctCodePipelineCloudFormationPolicy
33+
PolicyDocument:
34+
Version: 2012-10-17
35+
Statement:
36+
-
37+
Effect: Allow
38+
Action:
39+
- cloudformation:*
40+
- s3:*
41+
- iam:PassRole
42+
Resource: "*"
43+
-
44+
Effect: Allow
45+
Action:
46+
- kms:*
47+
Resource: !Ref CMKARN
48+
Roles:
49+
-
50+
!Ref CFRole
51+
CFDeployerRole:
52+
Type: AWS::IAM::Role
53+
Properties:
54+
RoleName: !Sub cloudformationdeployer-role
55+
AssumeRolePolicyDocument:
56+
Version: 2012-10-17
57+
Statement:
58+
-
59+
Effect: Allow
60+
Principal:
61+
Service:
62+
- cloudformation.amazonaws.com
63+
Action:
64+
- sts:AssumeRole
65+
Path: /
66+
CFDeployerPolicy:
67+
Type: AWS::IAM::Policy
68+
Properties:
69+
PolicyName: !Sub cloudformationdeployer-policy
70+
PolicyDocument:
71+
Version: 2012-10-17
72+
Statement:
73+
-
74+
Effect: Allow
75+
Action:
76+
- lambda:AddPermission
77+
- lambda:CreateFunction
78+
- lambda:DeleteFunction
79+
- lambda:InvokeFunction
80+
- lambda:RemovePermission
81+
- lambda:UpdateFunctionCode
82+
- lambda:GetFunctionConfiguration
83+
- lambda:GetFunction
84+
- lambda:UpdateFunctionConfiguration
85+
- events:* # Required for the sample lambda function to work
86+
- iam:CreateRole
87+
- iam:CreatePolicy
88+
- iam:GetRole
89+
- iam:DeleteRole
90+
- iam:PutRolePolicy
91+
- iam:PassRole
92+
- iam:DeleteRolePolicy
93+
- cloudformation:*
94+
Resource: "*"
95+
-
96+
Effect: Allow
97+
Action:
98+
- s3:PutObject
99+
- s3:GetBucketPolicy
100+
- s3:GetObject
101+
- s3:ListBucket
102+
Resource:
103+
- !Join ['',['arn:aws:s3:::',!Ref ArtifactsBucket, '/*']]
104+
- !Join ['',['arn:aws:s3:::',!Ref ArtifactsBucket]]
105+
Roles:
106+
-
107+
!Ref CFDeployerRole

0 commit comments

Comments
 (0)