carlin 1.19.11 → 1.19.13

package/dist/deploy/cicd/cicd.template.js

@@ -0,0 +1,922 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCicdTemplate = exports.getRepositoryImageBuilder = exports.IMAGE_UPDATER_SCHEDULE_SERVERLESS_FUNCTION_LOGICAL_ID = exports.PIPELINES_HANDLER_LAMBDA_FUNCTION_LOGICAL_ID = exports.PIPELINES_TAG_LOGICAL_ID = exports.PIPELINES_MAIN_LOGICAL_ID = exports.PIPELINES_ROLE_LOGICAL_ID = exports.PIPELINES_ARTIFACT_STORE_S3_BUCKET_LOGICAL_ID = exports.REPOSITORY_TASKS_ECS_TASK_DEFINITION_TASK_ROLE_LOGICAL_ID = exports.REPOSITORY_TASKS_ECS_TASK_DEFINITION_EXECUTION_ROLE_LOGICAL_ID = exports.REPOSITORY_TASKS_ECS_CLUSTER_LOGS_LOG_GROUP_LOGICAL_ID = exports.REPOSITORY_TASKS_ECS_CLUSTER_LOGICAL_ID = exports.REPOSITORY_IMAGE_CODE_BUILD_PROJECT_LOGICAL_ID = exports.REPOSITORY_ECS_TASK_DEFINITION_LOGICAL_ID = exports.REPOSITORY_ECS_TASK_CONTAINER_NAME = exports.PROCESS_ENV_REPOSITORY_IMAGE_CODE_BUILD_PROJECT_NAME = exports.ECS_TASK_REPORT_HANDLER_LAMBDA_FUNCTION_LOGICAL_ID = exports.FUNCTION_IAM_ROLE_LOGICAL_ID = exports.ECR_REPOSITORY_LOGICAL_ID = exports.CODE_BUILD_PROJECT_SERVICE_ROLE_LOGICAL_ID = exports.CODE_BUILD_PROJECT_LOGS_LOGICAL_ID = exports.API_LOGICAL_ID = void 0;
+const tslib_1 = require("tslib");
+const config_1 = require("../baseStack/config");
+const command_options_1 = require("./command.options");
+const utils_1 = require("../../utils");
+const config_2 = require("./config");
+const change_case_1 = require("change-case");
+const js_yaml_1 = tslib_1.__importDefault(require("js-yaml"));
+const getTriggerPipelineObjectKey_1 = require("./getTriggerPipelineObjectKey");
+exports.API_LOGICAL_ID = 'ApiV1ServerlessApi';
+exports.CODE_BUILD_PROJECT_LOGS_LOGICAL_ID = 'RepositoryImageCodeBuildProjectLogsLogGroup';
+exports.CODE_BUILD_PROJECT_SERVICE_ROLE_LOGICAL_ID = 'RepositoryImageCodeBuildProjectIAMRole';
+exports.ECR_REPOSITORY_LOGICAL_ID = 'RepositoryECRRepository';
+exports.FUNCTION_IAM_ROLE_LOGICAL_ID = 'ApiV1ServerlessFunctionIAMRole';
+exports.ECS_TASK_REPORT_HANDLER_LAMBDA_FUNCTION_LOGICAL_ID = 'EcsTaskReportHandler';
+exports.PROCESS_ENV_REPOSITORY_IMAGE_CODE_BUILD_PROJECT_NAME = 'REPOSITORY_IMAGE_CODE_BUILD_PROJECT_NAME';
+exports.REPOSITORY_ECS_TASK_CONTAINER_NAME = 'RepositoryECSTaskContainerName';
+exports.REPOSITORY_ECS_TASK_DEFINITION_LOGICAL_ID = 'RepositoryECSTaskDefinition';
+exports.REPOSITORY_IMAGE_CODE_BUILD_PROJECT_LOGICAL_ID = 'RepositoryImageCodeBuildProject';
+exports.REPOSITORY_TASKS_ECS_CLUSTER_LOGICAL_ID = 'RepositoryTasksECSCluster';
+exports.REPOSITORY_TASKS_ECS_CLUSTER_LOGS_LOG_GROUP_LOGICAL_ID = 'RepositoryTasksECSClusterLogsLogGroup';
+exports.REPOSITORY_TASKS_ECS_TASK_DEFINITION_EXECUTION_ROLE_LOGICAL_ID = 'RepositoryTasksECSTaskDefinitionExecutionRoleIAMRole';
+exports.REPOSITORY_TASKS_ECS_TASK_DEFINITION_TASK_ROLE_LOGICAL_ID = 'RepositoryTasksECSTaskDefinitionTaskRoleIAMRole';
+exports.PIPELINES_ARTIFACT_STORE_S3_BUCKET_LOGICAL_ID = 'PipelinesArtifactStoreS3Bucket';
+exports.PIPELINES_ROLE_LOGICAL_ID = 'PipelinesMainIAMRole';
+exports.PIPELINES_MAIN_LOGICAL_ID = 'PipelinesMainCodePipeline';
+exports.PIPELINES_TAG_LOGICAL_ID = 'PipelinesTagCodePipeline';
+exports.PIPELINES_HANDLER_LAMBDA_FUNCTION_LOGICAL_ID = 'PipelinesHandlerLambdaFunction';
+exports.IMAGE_UPDATER_SCHEDULE_SERVERLESS_FUNCTION_LOGICAL_ID = 'ImageUpdaterScheduleServerlessFunction';
+/**
+ * An [AWS CodeBuild](https://aws.amazon.com/codebuild/) project is created
+ * to build (create and update) repository images. It uses a
+ * [BUILD\_GENERAL1\_SMALL environment compute type](https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-compute-types.html)
+ * with Linux as operational system to build the image.
+ */
+const getRepositoryImageBuilder = () => ({
+    Type: 'AWS::CodeBuild::Project',
+    Properties: {
+        Artifacts: {
+            Type: 'NO_ARTIFACTS',
+        },
+        Cache: {
+            Location: 'LOCAL',
+            Modes: ['LOCAL_DOCKER_LAYER_CACHE'],
+            Type: 'LOCAL',
+        },
+        Description: 'Create repository image.',
+        Environment: {
+            ComputeType: 'BUILD_GENERAL1_SMALL',
+            EnvironmentVariables: [
+                {
+                    Name: 'AWS_ACCOUNT_ID',
+                    Value: { Ref: 'AWS::AccountId' },
+                },
+                {
+                    Name: 'AWS_REGION',
+                    Value: { Ref: 'AWS::Region' },
+                },
+                {
+                    Name: 'DOCKERFILE',
+                    Value: {
+                        'Fn::Sub': [
+                            'FROM public.ecr.aws/ubuntu/ubuntu:20.04_stable',
+                            // https://stackoverflow.com/a/59693182/8786986
+                            'ENV DEBIAN_FRONTEND noninteractive',
+                            // Make sure apt is up to date
+                            'RUN apt-get update --fix-missing',
+                            'RUN apt-get install -y curl',
+                            'RUN apt-get install -y git',
+                            'RUN apt-get install -y jq',
+                            // Install Node.js
+                            'RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash -',
+                            'RUN apt-get install -y nodejs',
+                            // Clean cache
+                            'RUN apt-get clean',
+                            // Install Yarn
+                            'RUN npm install -g yarn',
+                            // Install carlin CLI
+                            'RUN yarn global add carlin',
+                            // Configure git
+                            'RUN git config --global user.name carlin',
+                            'RUN git config --global user.email carlin@ttoss.dev',
+                            'RUN mkdir /root/.ssh/',
+                            'COPY ./id_rsa /root/.ssh/id_rsa',
+                            'RUN chmod 600 /root/.ssh/id_rsa',
+                            // Make sure your domain is accepted
+                            'RUN touch /root/.ssh/known_hosts',
+                            'RUN ssh-keyscan github.com >> /root/.ssh/known_hosts',
+                            // Copy repository
+                            'COPY . /home',
+                            // Go to repository directory
+                            'WORKDIR /home/repository',
+                            // Set Yarn cache
+                            'RUN mkdir -p /home/yarn-cache',
+                            'RUN yarn config set cache-folder /home/yarn-cache',
+                            'RUN yarn install',
+                            // Used in case of yarn.lock is modified.
+                            'RUN git checkout -- yarn.lock',
+                        ].join('\n'),
+                    },
+                },
+                {
+                    Name: 'IMAGE_TAG',
+                    Value: 'latest',
+                },
+                {
+                    Name: 'REPOSITORY_ECR_REPOSITORY',
+                    Value: { Ref: exports.ECR_REPOSITORY_LOGICAL_ID },
+                },
+                {
+                    Name: 'SSH_KEY',
+                    Value: { Ref: 'SSHKey' },
+                },
+                {
+                    Name: 'SSH_URL',
+                    Value: { Ref: 'SSHUrl' },
+                },
+            ],
+            Image: 'aws/codebuild/standard:3.0',
+            ImagePullCredentialsType: 'CODEBUILD',
+            /**
+             * Enables running the Docker daemon inside a Docker container. Set to
+             * true only if the build project is used to build Docker images.
+             * Otherwise, a build that attempts to interact with the Docker daemon
+             * fails. The default setting is false."
+             * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-codebuild-project-environment.html#cfn-codebuild-project-environment-privilegedmode
+             */
+            PrivilegedMode: true,
+            Type: 'LINUX_CONTAINER',
+        },
+        LogsConfig: {
+            CloudWatchLogs: {
+                Status: 'ENABLED',
+                GroupName: { Ref: exports.CODE_BUILD_PROJECT_LOGS_LOGICAL_ID },
+            },
+        },
+        ServiceRole: {
+            'Fn::GetAtt': [exports.CODE_BUILD_PROJECT_SERVICE_ROLE_LOGICAL_ID, 'Arn'],
+        },
+        Source: {
+            BuildSpec: js_yaml_1.default.dump({
+                version: '0.2',
+                phases: {
+                    install: {
+                        commands: [
+                            'echo install started on `date`',
+                            `echo "$SSH_KEY" > ~/.ssh/id_rsa`,
+                            'chmod 600 ~/.ssh/id_rsa',
+                            'rm -rf repository',
+                            'git clone $SSH_URL repository',
+                            'cd repository',
+                            'ls',
+                        ],
+                    },
+                    pre_build: {
+                        commands: ['echo pre_build started on `date`'],
+                    },
+                    build: {
+                        commands: [
+                            'echo build started on `date`',
+                            '$(aws ecr get-login --no-include-email --region $AWS_REGION)',
+                            'echo Building the repository image...',
+                            'cd ../',
+                            'cp ~/.ssh/id_rsa .',
+                            'echo "$DOCKERFILE" > Dockerfile',
+                            'cat Dockerfile',
+                            'docker build -t $REPOSITORY_ECR_REPOSITORY:$IMAGE_TAG -f Dockerfile .',
+                            'docker tag $REPOSITORY_ECR_REPOSITORY:$IMAGE_TAG $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/$REPOSITORY_ECR_REPOSITORY:$IMAGE_TAG',
+                            'echo Pushing the repository image...',
+                            'docker push $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/$REPOSITORY_ECR_REPOSITORY:$IMAGE_TAG',
+                        ],
+                    },
+                    post_build: {
+                        commands: ['echo post_build completed on `date`'],
+                    },
+                },
+            }),
+            Type: 'NO_SOURCE',
+        },
+        TimeoutInMinutes: 15,
+    },
+});
+exports.getRepositoryImageBuilder = getRepositoryImageBuilder;
+/**
+ * This variable is used inside GitHub webhooks to identify the object key
+ * prefix of the file that triggers the pipelines.
+ */
+const triggerPipelinesObjectKeyPrefix = [
+    'cicd',
+    'pipelines',
+    'triggers',
+    (0, utils_1.getProjectName)(),
+].join('/');
+const getCicdTemplate = ({ pipelines = [], cpu = config_2.ECS_TASK_DEFAULT_CPU, memory = config_2.ECS_TASK_DEFAULT_MEMORY, s3, slackWebhookUrl, taskEnvironment = [], }) => {
+    const resources = {};
+    const executeEcsTaskVariables = {
+        ECS_CLUSTER_ARN: {
+            'Fn::GetAtt': [exports.REPOSITORY_TASKS_ECS_CLUSTER_LOGICAL_ID, 'Arn'],
+        },
+        ECS_CONTAINER_NAME: exports.REPOSITORY_ECS_TASK_CONTAINER_NAME,
+        ECS_TASK_DEFINITION: {
+            Ref: exports.REPOSITORY_ECS_TASK_DEFINITION_LOGICAL_ID,
+        },
+        VPC_SECURITY_GROUP: {
+            'Fn::ImportValue': config_1.BASE_STACK_VPC_DEFAULT_SECURITY_GROUP_EXPORTED_NAME,
+        },
+        VPC_PUBLIC_SUBNET_0: {
+            'Fn::ImportValue': config_1.BASE_STACK_VPC_PUBLIC_SUBNET_0_EXPORTED_NAME,
+        },
+        VPC_PUBLIC_SUBNET_1: {
+            'Fn::ImportValue': config_1.BASE_STACK_VPC_PUBLIC_SUBNET_1_EXPORTED_NAME,
+        },
+        VPC_PUBLIC_SUBNET_2: {
+            'Fn::ImportValue': config_1.BASE_STACK_VPC_PUBLIC_SUBNET_2_EXPORTED_NAME,
+        },
+        ECS_TASK_REPORT_HANDLER_NAME: {
+            Ref: exports.ECS_TASK_REPORT_HANDLER_LAMBDA_FUNCTION_LOGICAL_ID,
+        },
+    };
+    /**
+     * The algorithm will clone the repository and will create a Docker image
+     * to be used to perform your commands. [Yarn cache](https://classic.yarnpkg.com/en/docs/cli/cache/)
+     * will also be saved together with the code to reduce packages installation
+     * time. The created image will be pushed to [Amazon Elastic Container Registry](https://aws.amazon.com/ecr/).
+     * with a defined expiration rule is also defined. The registry only keeps
+     * the latest image.
+     */
+    const getEcrRepositoryResource = () => ({
+        Type: 'AWS::ECR::Repository',
+        Properties: {
+            LifecyclePolicy: {
+                LifecyclePolicyText: JSON.stringify({
+                    rules: [
+                        {
+                            rulePriority: 1,
+                            description: 'Only keep the latest image',
+                            selection: {
+                                tagStatus: 'any',
+                                countType: 'imageCountMoreThan',
+                                countNumber: 1,
+                            },
+                            action: {
+                                type: 'expire',
+                            },
+                        },
+                    ],
+                }, null, 2),
+            },
+        },
+    });
+    resources[exports.ECR_REPOSITORY_LOGICAL_ID] = getEcrRepositoryResource();
+    const commonFunctionProperties = {
+        CodeUri: {
+            Bucket: s3.bucket,
+            Key: s3.key,
+            Version: s3.versionId,
+        },
+        Role: {
+            'Fn::GetAtt': [exports.FUNCTION_IAM_ROLE_LOGICAL_ID, 'Arn'],
+        },
+        Runtime: 'nodejs14.x',
+        Timeout: 60,
+    };
+    /**
+     * CodeBuild
+     */
+    (() => {
+        resources[exports.CODE_BUILD_PROJECT_LOGS_LOGICAL_ID] = {
+            Type: 'AWS::Logs::LogGroup',
+            DeletionPolicy: 'Delete',
+            Properties: {},
+        };
+        resources[exports.CODE_BUILD_PROJECT_SERVICE_ROLE_LOGICAL_ID] = {
+            Type: 'AWS::IAM::Role',
+            Properties: {
+                AssumeRolePolicyDocument: {
+                    Version: '2012-10-17',
+                    Statement: [
+                        {
+                            Effect: 'Allow',
+                            Principal: {
+                                Service: 'codebuild.amazonaws.com',
+                            },
+                            Action: 'sts:AssumeRole',
+                        },
+                    ],
+                },
+                Path: (0, utils_1.getIamPath)(),
+                Policies: [
+                    {
+                        PolicyName: `${exports.CODE_BUILD_PROJECT_SERVICE_ROLE_LOGICAL_ID}Policy`,
+                        PolicyDocument: {
+                            Version: '2012-10-17',
+                            Statement: [
+                                {
+                                    Effect: 'Allow',
+                                    Action: ['logs:CreateLogStream', 'logs:PutLogEvents'],
+                                    Resource: '*',
+                                },
+                                {
+                                    Effect: 'Allow',
+                                    Action: ['ecr:GetAuthorizationToken'],
+                                    Resource: '*',
+                                },
+                                {
+                                    Effect: 'Allow',
+                                    Action: [
+                                        'ecr:BatchCheckLayerAvailability',
+                                        'ecr:CompleteLayerUpload',
+                                        'ecr:InitiateLayerUpload',
+                                        'ecr:PutImage',
+                                        'ecr:UploadLayerPart',
+                                    ],
+                                    Resource: {
+                                        'Fn::GetAtt': [exports.ECR_REPOSITORY_LOGICAL_ID, 'Arn'],
+                                    },
+                                },
+                            ],
+                        },
+                    },
+                ],
+            },
+        };
+        resources[exports.REPOSITORY_IMAGE_CODE_BUILD_PROJECT_LOGICAL_ID] =
+            (0, exports.getRepositoryImageBuilder)();
+        const cicdConfig = {
+            ...(0, command_options_1.getCicdConfig)(),
+            'ssh-key': '/root/.ssh/id_rsa',
+            environment: (0, utils_1.getEnvironment)(),
+        };
+        resources[exports.IMAGE_UPDATER_SCHEDULE_SERVERLESS_FUNCTION_LOGICAL_ID] = {
+            Type: 'AWS::Serverless::Function',
+            Properties: {
+                ...commonFunctionProperties,
+                Events: {
+                    Schedule: {
+                        Type: 'Schedule',
+                        Properties: {
+                            Schedule: 'rate(7 days)',
+                        },
+                    },
+                },
+                Environment: {
+                    Variables: {
+                        [exports.PROCESS_ENV_REPOSITORY_IMAGE_CODE_BUILD_PROJECT_NAME]: {
+                            Ref: exports.REPOSITORY_IMAGE_CODE_BUILD_PROJECT_LOGICAL_ID,
+                        },
+                        CICD_CONFIG: JSON.stringify(cicdConfig),
+                        ...executeEcsTaskVariables,
+                    },
+                },
+                Handler: 'index.imageUpdaterScheduleHandler',
+            },
+        };
+    })();
+    const createApiResources = () => {
+        resources[exports.API_LOGICAL_ID] = {
+            Type: 'AWS::Serverless::Api',
+            Properties: {
+                Auth: {
+                    ApiKeyRequired: false,
+                },
+                StageName: 'v1',
+            },
+        };
+        resources[exports.FUNCTION_IAM_ROLE_LOGICAL_ID] = {
+            Type: 'AWS::IAM::Role',
+            Properties: {
+                AssumeRolePolicyDocument: {
+                    Version: '2012-10-17',
+                    Statement: [
+                        {
+                            Effect: 'Allow',
+                            Principal: {
+                                Service: 'lambda.amazonaws.com',
+                            },
+                            Action: ['sts:AssumeRole'],
+                        },
+                    ],
+                },
+                ManagedPolicyArns: [
+                    'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
+                ],
+                Path: (0, utils_1.getIamPath)(),
+                Policies: [
+                    {
+                        PolicyName: `${exports.FUNCTION_IAM_ROLE_LOGICAL_ID}Policy`,
+                        PolicyDocument: {
+                            Version: '2012-10-17',
+                            Statement: [
+                                {
+                                    Effect: 'Allow',
+                                    Action: ['codebuild:StartBuild'],
+                                    Resource: {
+                                        'Fn::GetAtt': [
+                                            exports.REPOSITORY_IMAGE_CODE_BUILD_PROJECT_LOGICAL_ID,
+                                            'Arn',
+                                        ],
+                                    },
+                                },
+                                {
+                                    Effect: 'Allow',
+                                    Action: ['iam:PassRole'],
+                                    Resource: [
+                                        {
+                                            'Fn::GetAtt': [
+                                                exports.REPOSITORY_TASKS_ECS_TASK_DEFINITION_EXECUTION_ROLE_LOGICAL_ID,
+                                                'Arn',
+                                            ],
+                                        },
+                                        {
+                                            'Fn::GetAtt': [
+                                                exports.REPOSITORY_TASKS_ECS_TASK_DEFINITION_TASK_ROLE_LOGICAL_ID,
+                                                'Arn',
+                                            ],
+                                        },
+                                    ],
+                                },
+                                {
+                                    Effect: 'Allow',
+                                    Action: ['ecs:DescribeTasks'],
+                                    Resource: '*',
+                                },
+                                {
+                                    Effect: 'Allow',
+                                    Action: ['ecs:RunTask'],
+                                    Resource: [
+                                        {
+                                            Ref: exports.REPOSITORY_ECS_TASK_DEFINITION_LOGICAL_ID,
+                                        },
+                                    ],
+                                },
+                                {
+                                    Action: [
+                                        'codepipeline:PutApprovalResult',
+                                        'codepipeline:GetJobDetails',
+                                        'codepipeline:GetPipelineState',
+                                        'codepipeline:PutJobSuccessResult',
+                                        'codepipeline:PutJobFailureResult',
+                                    ],
+                                    Effect: 'Allow',
+                                    Resource: '*',
+                                },
+                                {
+                                    Action: 's3:*',
+                                    Effect: 'Allow',
+                                    Resource: {
+                                        'Fn::Sub': [
+                                            `arn:aws:s3:::\${BucketName}/${triggerPipelinesObjectKeyPrefix}*`,
+                                            {
+                                                BucketName: {
+                                                    'Fn::ImportValue': config_1.BASE_STACK_BUCKET_NAME_EXPORTED_NAME,
+                                                },
+                                            },
+                                        ],
+                                    },
+                                },
+                            ],
+                        },
+                    },
+                ],
+            },
+        };
+        /**
+         * Called after ECS task execution success or failure.
+         */
+        resources[exports.ECS_TASK_REPORT_HANDLER_LAMBDA_FUNCTION_LOGICAL_ID] = {
+            Type: 'AWS::Serverless::Function',
+            Properties: {
+                ...commonFunctionProperties,
+                Environment: {
+                    Variables: {
+                        ECS_TASK_LOGS_LOG_GROUP: {
+                            Ref: exports.REPOSITORY_TASKS_ECS_CLUSTER_LOGS_LOG_GROUP_LOGICAL_ID,
+                        },
+                        ECS_TASK_CONTAINER_NAME: exports.REPOSITORY_ECS_TASK_CONTAINER_NAME,
+                        SLACK_WEBHOOK_URL: slackWebhookUrl,
+                    },
+                },
+                Handler: 'index.ecsTaskReportHandler',
+            },
+        };
+        resources.CicdApiV1ServerlessFunction = {
+            Type: 'AWS::Serverless::Function',
+            Properties: {
+                ...commonFunctionProperties,
+                Events: {
+                    ApiEvent: {
+                        Type: 'Api',
+                        Properties: {
+                            Method: 'POST',
+                            Path: '/cicd',
+                            RestApiId: { Ref: exports.API_LOGICAL_ID },
+                        },
+                    },
+                },
+                Environment: {
+                    Variables: {
+                        [exports.PROCESS_ENV_REPOSITORY_IMAGE_CODE_BUILD_PROJECT_NAME]: {
+                            Ref: exports.REPOSITORY_IMAGE_CODE_BUILD_PROJECT_LOGICAL_ID,
+                        },
+                        ...executeEcsTaskVariables,
+                    },
+                },
+                Handler: 'index.cicdApiV1Handler',
+            },
+        };
+        resources.GitHubWebhooksApiV1ServerlessFunction = {
+            Type: 'AWS::Serverless::Function',
+            Properties: {
+                ...commonFunctionProperties,
+                Events: {
+                    ApiEvent: {
+                        Type: 'Api',
+                        Properties: {
+                            Method: 'POST',
+                            Path: '/github/webhooks',
+                            RestApiId: { Ref: exports.API_LOGICAL_ID },
+                        },
+                    },
+                },
+                Environment: {
+                    Variables: {
+                        BASE_STACK_BUCKET_NAME: {
+                            'Fn::ImportValue': config_1.BASE_STACK_BUCKET_NAME_EXPORTED_NAME,
+                        },
+                        TRIGGER_PIPELINES_OBJECT_KEY_PREFIX: triggerPipelinesObjectKeyPrefix,
+                        PIPELINES_JSON: JSON.stringify(pipelines),
+                        ...executeEcsTaskVariables,
+                    },
+                },
+                Handler: 'index.githubWebhooksApiV1Handler',
+            },
+        };
+    };
+    createApiResources();
+    /**
+     * ECS
+     */
+    (() => {
+        resources[exports.REPOSITORY_TASKS_ECS_CLUSTER_LOGICAL_ID] = {
+            Type: 'AWS::ECS::Cluster',
+            Properties: {},
+        };
+        resources[exports.REPOSITORY_TASKS_ECS_CLUSTER_LOGS_LOG_GROUP_LOGICAL_ID] = {
+            Type: 'AWS::Logs::LogGroup',
+            DeletionPolicy: 'Delete',
+            Properties: {},
+        };
+        /**
+         * Used to start the container.
+         */
+        resources[exports.REPOSITORY_TASKS_ECS_TASK_DEFINITION_EXECUTION_ROLE_LOGICAL_ID] =
+            {
+                Type: 'AWS::IAM::Role',
+                Properties: {
+                    AssumeRolePolicyDocument: {
+                        Version: '2012-10-17',
+                        Statement: [
+                            {
+                                Effect: 'Allow',
+                                Principal: {
+                                    Service: 'ecs-tasks.amazonaws.com',
+                                },
+                                Action: 'sts:AssumeRole',
+                            },
+                        ],
+                    },
+                    ManagedPolicyArns: [
+                        'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy',
+                    ],
+                    Path: (0, utils_1.getIamPath)(),
+                },
+            };
+        /**
+         * Used inside de container execution.
+         */
+        resources[exports.REPOSITORY_TASKS_ECS_TASK_DEFINITION_TASK_ROLE_LOGICAL_ID] = {
+            Type: 'AWS::IAM::Role',
+            Properties: {
+                AssumeRolePolicyDocument: {
+                    Version: '2012-10-17',
+                    Statement: [
+                        {
+                            Effect: 'Allow',
+                            Principal: {
+                                Service: 'ecs-tasks.amazonaws.com',
+                            },
+                            Action: 'sts:AssumeRole',
+                        },
+                    ],
+                },
+                ManagedPolicyArns: [
+                    'arn:aws:iam::aws:policy/job-function/ViewOnlyAccess',
+                ],
+                Path: (0, utils_1.getIamPath)(),
+                /**
+                 * TODO: improve the policies rules.
+                 */
+                Policies: [
+                    {
+                        PolicyName: `${exports.REPOSITORY_TASKS_ECS_TASK_DEFINITION_TASK_ROLE_LOGICAL_ID}Policy`,
+                        PolicyDocument: {
+                            Version: '2012-10-17',
+                            Statement: [
+                                {
+                                    Effect: 'Allow',
+                                    Action: ['*'],
+                                    Resource: '*',
+                                },
+                            ],
+                        },
+                    },
+                ],
+            },
+        };
+        resources[exports.REPOSITORY_ECS_TASK_DEFINITION_LOGICAL_ID] = {
+            Type: 'AWS::ECS::TaskDefinition',
+            Properties: {
+                ContainerDefinitions: [
+                    {
+                        Environment: [
+                            {
+                                /**
+                                 * https://docs.aws.amazon.com/AmazonECS/latest/developerguide/container-metadata.html#enable-metadata
+                                 */
+                                Name: 'ECS_ENABLE_CONTAINER_METADATA',
+                                Value: 'true',
+                            },
+                            {
+                                Name: 'CI',
+                                Value: 'true',
+                            },
+                            ...taskEnvironment.map((te) => ({
+                                Name: te.name,
+                                Value: te.value,
+                            })),
+                        ],
+                        Image: {
+                            'Fn::Sub': [
+                                // eslint-disable-next-line no-template-curly-in-string
+                                '${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${RepositoryECR}:latest',
+                                {
+                                    RepositoryECR: { Ref: exports.ECR_REPOSITORY_LOGICAL_ID },
+                                },
+                            ],
+                        },
+                        LogConfiguration: {
+                            LogDriver: 'awslogs',
+                            Options: {
+                                'awslogs-group': {
+                                    Ref: exports.REPOSITORY_TASKS_ECS_CLUSTER_LOGS_LOG_GROUP_LOGICAL_ID,
+                                },
+                                'awslogs-region': { Ref: 'AWS::Region' },
+                                'awslogs-stream-prefix': 'ecs',
+                            },
+                        },
+                        Name: exports.REPOSITORY_ECS_TASK_CONTAINER_NAME,
+                    },
+                ],
+                Cpu: cpu,
+                ExecutionRoleArn: {
+                    'Fn::GetAtt': [
+                        exports.REPOSITORY_TASKS_ECS_TASK_DEFINITION_EXECUTION_ROLE_LOGICAL_ID,
+                        'Arn',
+                    ],
+                },
+                Memory: memory,
+                NetworkMode: 'awsvpc',
+                RequiresCompatibilities: ['FARGATE'],
+                TaskRoleArn: {
+                    'Fn::GetAtt': [
+                        exports.REPOSITORY_TASKS_ECS_TASK_DEFINITION_TASK_ROLE_LOGICAL_ID,
+                        'Arn',
+                    ],
+                },
+            },
+        };
+    })();
+    /**
+     * Pipelines
+     */
+    if (pipelines.includes('main') || pipelines.includes('tag')) {
+        resources[exports.PIPELINES_ARTIFACT_STORE_S3_BUCKET_LOGICAL_ID] = {
+            Type: 'AWS::S3::Bucket',
+            Properties: {
+                LifecycleConfiguration: {
+                    Rules: [
+                        {
+                            /**
+                             * We won't use the artifacts forever.
+                             */
+                            ExpirationInDays: 7,
+                            Status: 'Enabled',
+                        },
+                    ],
+                },
+            },
+        };
+        resources[exports.PIPELINES_HANDLER_LAMBDA_FUNCTION_LOGICAL_ID] = {
+            Type: 'AWS::Lambda::Function',
+            Properties: {
+                Code: {
+                    S3Bucket: s3.bucket,
+                    S3Key: s3.key,
+                    S3ObjectVersion: s3.versionId,
+                },
+                Environment: {
+                    Variables: {
+                        ...executeEcsTaskVariables,
+                    },
+                },
+                Handler: 'index.pipelinesHandler',
+                MemorySize: 128,
+                Role: {
+                    'Fn::GetAtt': [exports.FUNCTION_IAM_ROLE_LOGICAL_ID, 'Arn'],
+                },
+                Runtime: 'nodejs14.x',
+                Timeout: 60,
+            },
+        };
+        resources[exports.PIPELINES_ROLE_LOGICAL_ID] = {
+            Type: 'AWS::IAM::Role',
+            Properties: {
+                AssumeRolePolicyDocument: {
+                    Version: '2012-10-17',
+                    Statement: [
+                        {
+                            Effect: 'Allow',
+                            Principal: {
+                                Service: 'codepipeline.amazonaws.com',
+                            },
+                            Action: 'sts:AssumeRole',
+                        },
+                    ],
+                },
+                ManagedPolicyArns: [],
+                Path: (0, utils_1.getIamPath)(),
+                Policies: [
+                    {
+                        PolicyName: `${exports.PIPELINES_ROLE_LOGICAL_ID}Policy`,
+                        PolicyDocument: {
+                            Version: '2012-10-17',
+                            Statement: [
+                                {
+                                    Effect: 'Allow',
+                                    Action: 'lambda:InvokeFunction',
+                                    Resource: [
+                                        {
+                                            'Fn::GetAtt': [
+                                                exports.PIPELINES_HANDLER_LAMBDA_FUNCTION_LOGICAL_ID,
+                                                'Arn',
+                                            ],
+                                        },
+                                    ],
+                                },
+                                {
+                                    Effect: 'Allow',
+                                    Action: 's3:*',
+                                    Resource: [
+                                        {
+                                            'Fn::GetAtt': [
+                                                exports.PIPELINES_ARTIFACT_STORE_S3_BUCKET_LOGICAL_ID,
+                                                'Arn',
+                                            ],
+                                        },
+                                        {
+                                            'Fn::Sub': `arn:aws:s3:::\${${exports.PIPELINES_ARTIFACT_STORE_S3_BUCKET_LOGICAL_ID}}/*`,
+                                        },
+                                    ],
+                                },
+                                {
+                                    Effect: 'Allow',
+                                    Action: 's3:*',
+                                    Resource: {
+                                        'Fn::Sub': [
+                                            `arn:aws:s3:::\${BucketName}/${triggerPipelinesObjectKeyPrefix}*`,
+                                            {
+                                                BucketName: {
+                                                    'Fn::ImportValue': config_1.BASE_STACK_BUCKET_NAME_EXPORTED_NAME,
+                                                },
+                                            },
+                                        ],
+                                    },
+                                },
+                                {
+                                    Effect: 'Allow',
+                                    Action: ['s3:Get*', 's3:List*'],
+                                    Resource: {
+                                        'Fn::Sub': [
+                                            `arn:aws:s3:::\${BucketName}`,
+                                            {
+                                                BucketName: {
+                                                    'Fn::ImportValue': config_1.BASE_STACK_BUCKET_NAME_EXPORTED_NAME,
+                                                },
+                                            },
+                                        ],
+                                    },
+                                },
+                            ],
+                        },
+                    },
+                ],
+            },
+        };
+        const getCodePipelinePipeline = (pipeline) => {
+            const pipelinePascalCase = (0, change_case_1.pascalCase)(pipeline);
+            const pipelineS3SourceOutputName = `Pipeline${pipelinePascalCase}S3SourceOutput`;
+            return {
+                Type: 'AWS::CodePipeline::Pipeline',
+                Properties: {
+                    ArtifactStore: {
+                        Location: { Ref: exports.PIPELINES_ARTIFACT_STORE_S3_BUCKET_LOGICAL_ID },
+                        Type: 'S3',
+                    },
+                    RestartExecutionOnUpdate: false,
+                    RoleArn: {
+                        'Fn::GetAtt': [exports.PIPELINES_ROLE_LOGICAL_ID, 'Arn'],
+                    },
+                    Stages: [
+                        {
+                            Actions: [
+                                {
+                                    ActionTypeId: {
+                                        Category: 'Source',
+                                        Owner: 'AWS',
+                                        Provider: 'S3',
+                                        Version: 1,
+                                    },
+                                    Configuration: {
+                                        S3Bucket: {
+                                            'Fn::ImportValue': config_1.BASE_STACK_BUCKET_NAME_EXPORTED_NAME,
+                                        },
+                                        S3ObjectKey: (0, getTriggerPipelineObjectKey_1.getTriggerPipelinesObjectKey)({
+                                            prefix: triggerPipelinesObjectKeyPrefix,
+                                            pipeline,
+                                        }),
+                                    },
+                                    Name: `Pipeline${pipelinePascalCase}S3SourceAction`,
+                                    OutputArtifacts: [
+                                        {
+                                            Name: pipelineS3SourceOutputName,
+                                        },
+                                    ],
+                                },
+                            ],
+                            Name: `Pipeline${pipelinePascalCase}S3SourceStage`,
+                        },
+                        {
+                            Actions: [
+                                {
+                                    ActionTypeId: {
+                                        Category: 'Invoke',
+                                        Owner: 'AWS',
+                                        Provider: 'Lambda',
+                                        Version: 1,
+                                    },
+                                    Configuration: {
+                                        FunctionName: {
+                                            Ref: exports.PIPELINES_HANDLER_LAMBDA_FUNCTION_LOGICAL_ID,
+                                        },
+                                        UserParameters: (() => pipeline)(),
+                                    },
+                                    InputArtifacts: [
+                                        {
+                                            Name: pipelineS3SourceOutputName,
+                                        },
+                                    ],
+                                    Name: `Pipeline${pipelinePascalCase}RunECSTasksAction`,
+                                },
+                                {
+                                    ActionTypeId: {
+                                        Category: 'Approval',
+                                        Owner: 'AWS',
+                                        Provider: 'Manual',
+                                        Version: 1,
+                                    },
+                                    Name: config_2.PIPELINE_ECS_TASK_EXECUTION_MANUAL_APPROVAL_ACTION_NAME,
+                                },
+                            ],
+                            Name: config_2.PIPELINE_ECS_TASK_EXECUTION_STAGE_NAME,
+                        },
+                    ],
+                },
+            };
+        };
+        if (pipelines.includes('main')) {
+            resources[exports.PIPELINES_MAIN_LOGICAL_ID] = getCodePipelinePipeline('main');
+        }
+        if (pipelines.includes('tag')) {
+            resources[exports.PIPELINES_TAG_LOGICAL_ID] = getCodePipelinePipeline('tag');
+        }
+    }
+    return {
+        AWSTemplateFormatVersion: '2010-09-09',
+        Transform: 'AWS::Serverless-2016-10-31',
+        Resources: resources,
+        Parameters: {
+            SSHKey: {
+                NoEcho: true,
+                Type: 'String',
+            },
+            SSHUrl: {
+                Type: 'String',
+            },
+        },
+        Outputs: {
+            [exports.REPOSITORY_IMAGE_CODE_BUILD_PROJECT_LOGICAL_ID]: {
+                Value: { Ref: exports.REPOSITORY_IMAGE_CODE_BUILD_PROJECT_LOGICAL_ID },
+            },
+            ApiV1Endpoint: {
+                Description: 'CICD API v1 stage endpoint.',
+                Value: {
+                    'Fn::Sub': `https://\${${exports.API_LOGICAL_ID}}.execute-api.\${AWS::Region}.amazonaws.com/v1/`,
+                },
+            },
+        },
+    };
+};
+exports.getCicdTemplate = getCicdTemplate;