bootstrap.yaml

Description: Provisions a custom role and oidc provider to connect aws and github actions & deploys terraform state resources
Parameters:
  Environment:
    Description: Select The Environment Type
    Default: dev
    AllowedValues:
      - dev
      - preprod
      - prod
    Type: String
  GitHubOrg:
    Description: The Name of your github organization.
    Default: "sagemaker-mlops-terraform"
    Type: String
  OIDCProviderArn:
    Description: Arn for the GitHub OIDC Provider.
    Default: ""
    Type: String
  TerraformStateBucketPrefix:
    Type: String
    Default: terraform-state
    Description: A prefix for S3 bucket name, account id will be added to ensure global uniqueness
  TerraformStateLockTableName:
    Type: String
    Default: terraform-state-locks
Conditions:
  CreateOIDCProvider: !Equals
    - !Ref OIDCProviderArn
    - ""

Resources:
  Role:
    Type: "AWS::IAM::Role"
    Properties:
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AdministratorAccess"
      RoleName: aws-github-oidc-role
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: "sts:AssumeRoleWithWebIdentity"
            Principal:
              Federated: !If
                - CreateOIDCProvider
                - !Ref GithubOidc
                - !Ref OIDCProviderArn
            Condition:
              "StringLike":
                "token.actions.githubusercontent.com:aud": sts.amazonaws.com
                "token.actions.githubusercontent.com:sub":
                  - !Sub "repo:${GitHubOrg}/*:*"

  GithubOidc:
    Type: "AWS::IAM::OIDCProvider"
    Condition: CreateOIDCProvider
    Properties:
      Url: https://token.actions.githubusercontent.com
      ClientIdList:
        - sts.amazonaws.com
      ThumbprintList:
        - 6938fd4d98bab03faadb97b34396831e3780aea1
        - 1c58a3a8518e8759bf075b76b750d4f2df264fcd
  TerraformStateS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${TerraformStateBucketPrefix}-${Environment}-${AWS::Region}-${AWS::AccountId}"
      AccessControl: Private
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled

  TerraformStateS3BucketBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref TerraformStateS3Bucket
      PolicyDocument:
        Statement:
          - Sid: DenyDeletingTerraformStateFiles
            Effect: Deny
            Principal: "*"
            Action: "s3:DeleteObject"
            Resource: !Sub "arn:aws:s3:::${TerraformStateS3Bucket}/*"

  TerraformStateLockDynamoDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Sub "${TerraformStateLockTableName}-${Environment}"
      AttributeDefinitions:
        - AttributeName: LockID
          AttributeType: S
      KeySchema:
        - AttributeName: LockID
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      SSESpecification:
        SSEEnabled: true
      Tags:
        # Add custom tags as CloudFormation is not able to add these unlike S3
        - Key: aws-cloudformation-stack-id
          Value: !Ref "AWS::StackId"
        - Key: aws-cloudformation-stack-name
          Value: !Ref "AWS::StackName"
        - Key: aws-cloudformation-logical-id
          Value: TerraformStateLockDynamoDBTable
Outputs:
  Role:
    Value: !GetAtt Role.Arn