wjordan / aws-starter-kit

Infrastructure continuous delivery using GitHub, AWS CodePipeline and CloudFormation

cfn-starter-kit

This project contains a reference implementation (starter template and setup instructions) for an "infrastructure continuous delivery" architecture using GitHub, AWS CodePipeline and CloudFormation.

Getting Started

1. Fork this repo.
2. Bootstrap the CloudFormation stack: a. a. b. Enter the forked repo's owner in the GitHubOwner field. c. Create a New personal access token with repo and admin:repo_hook scopes, and enter the token in the GitHubToken field. d. Enter the name of an existing S3 bucket for storing pipeline artifacts in the ArtifactBucket field. (Create a bucket first if necessary.)
3. Verify the newly-created stack and pipeline. a. Check the CloudFormation Console to ensure your stack reaches the CREATE_COMPLETE state successfully. b. Check the CodePipeline Console to ensure the pipeline's Source and Deploy stages both completed successfully.
4. Update the CloudFormation stack: a. Modify cfn-template.yml in the Git repository and commit/push the change. b. For example, try renaming Topic to NewTopic.
5. Verify the stack update. a. Check the CodePipeline Console to ensure the pipeline processes the new commit in both stages. b. Check the CloudFormation Console to ensure your stack reaches the UPDATE_COMPLETE state successfully. c. Verify the created/updated resources. For example, check the SNS Topics Console for the newly-created NewTopic resource.

That's it!

Note: The CloudFormation Service Role (CFNRole) allows full permissions ('*'). For more restricted, fine-grained security, you should move the CFNRole and PipelineRole resources into a separate CloudFormation stack, reference them using Fn::ImportValue, and ensure that CFNRole grants least privilege.

References

Talk from re:Invent 2016, "Infrastructure Continuous Delivery Using AWS CloudFormation"