Sorry

This feed does not validate.

In addition, interoperability with the widest range of feed readers could be improved by implementing the following recommendations.

Source: http://feeds.feedburner.com/kbild

  1. <?xml version="1.0" encoding="utf-8" standalone="yes"?>
  2. <rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  3.  <channel>
  4.    <title>kbild</title>
  5.    <link>https://kbild.ch/</link>
  6.    <description>Recent content on kbild</description>
  7.    <generator>Hugo -- gohugo.io</generator>
  8.    <language>en-us</language>
  9.    <copyright>This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.</copyright>
  10.    <lastBuildDate>Thu, 12 Nov 2020 14:00:00 +0200</lastBuildDate>
  11.    
  12. <atom:link href="https://kbild.ch/index.xml" rel="self" type="application/rss+xml" />
  13.    
  14.    
  15.    <item>
  16.      <title>Create a Custom Source for AWS CodePipeline - How to Use Azure DevOps Repos with AWS Pipelines - Part 1</title>
  17.      <link>https://kbild.ch/blog/2020-11-11-custom_codepipeline_source/</link>
  18.      <pubDate>Thu, 12 Nov 2020 14:00:00 +0200</pubDate>
  19.      
  20.      <guid>https://kbild.ch/blog/2020-11-11-custom_codepipeline_source/</guid>
  21. <description>&lt;div class=&#34;paragraph&#34;&gt;
  22. &lt;p&gt;Recently a very interesting blog post on the AWS DevOps blog was published which goes into much detail&lt;br/&gt;
  23. &lt;a href=&#34;https://aws.amazon.com/blogs/devops/event-driven-architecture-for-using-third-party-git-repositories-as-source-for-aws-codepipeline/&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;how to use third-party Git repositories as source for your AWS CodePipelines&lt;/a&gt;.&lt;br/&gt;&lt;/p&gt;
  24. &lt;/div&gt;
  25. &lt;div class=&#34;paragraph&#34;&gt;
  26. &lt;p&gt;Unfortunately, this article came too late for our own integration of Azure DevOps Repos into our AWS CI/CD Pipelines and we had to find our own solution when we started to move our code Repos to Azure DevOps earlier this year.&lt;br/&gt;
  27. &lt;br/&gt;
  28. I’m happy to share some more details how we succeeded with this integration using a custom source for AWS CodePipeline.
  29. In this Part 1 of the blog posts I will show you all details of the solution and in a Part 2 I plan to describe every step which is needed to deploy such a solution.&lt;br/&gt;
  30. &lt;br/&gt;&lt;/p&gt;
  31. &lt;/div&gt;
  32. &lt;hr/&gt;
  33. &lt;h3 id=&#34;_solution_overview&#34; class=&#34;discrete&#34;&gt;Solution Overview&lt;/h3&gt;
  34. &lt;div class=&#34;paragraph&#34;&gt;
  35. &lt;p&gt;Big parts of the solution are equal to the architecture described in the &lt;a href=&#34;https://aws.amazon.com/blogs/devops/event-driven-architecture-for-using-third-party-git-repositories-as-source-for-aws-codepipeline/&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;Blog post by Kirankumar&lt;/a&gt; but there are some small but important differences.&lt;br/&gt;&lt;/p&gt;
  36. &lt;/div&gt;
  37. &lt;div class=&#34;paragraph&#34;&gt;
  38. &lt;p&gt;Let’s look at the architecture of our solution:
  39. &lt;br/&gt;&lt;/p&gt;
  40. &lt;/div&gt;
  41. &lt;div class=&#34;imageblock&#34;&gt;
  42. &lt;div class=&#34;content&#34;&gt;
  43. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/202011/CustomSourcePipelineArch.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/202011/CustomSourcePipelineArch.png&#34; alt=&#34;SolutionOverview&#34;/&gt;&lt;/a&gt;
  44. &lt;/div&gt;
  45. &lt;/div&gt;
  46. &lt;div class=&#34;paragraph&#34;&gt;
  47. &lt;p&gt;&lt;br/&gt;
  48. Let’s go through all the steps:&lt;/p&gt;
  49. &lt;/div&gt;
  50. &lt;div class=&#34;olist arabic&#34;&gt;
  51. &lt;ol class=&#34;arabic&#34;&gt;
  52. &lt;li&gt;
  53. &lt;p&gt;A developer commits a code change to the Azure DevOps Repo&lt;/p&gt;
  54. &lt;/li&gt;
  55. &lt;li&gt;
  56. &lt;p&gt;The commit triggers an Azure DevOps webhook&lt;/p&gt;
  57. &lt;/li&gt;
  58. &lt;li&gt;
  59. &lt;p&gt;The Azure DevOps webhook calls a CodePipeline webhook&lt;/p&gt;
  60. &lt;/li&gt;
  61. &lt;li&gt;
  62. &lt;p&gt;The webhook starts the CodePipeline&lt;/p&gt;
  63. &lt;/li&gt;
  64. &lt;li&gt;
  65. &lt;p&gt;The CodePipeline puts the first stage into &amp;#39;Progress&amp;#39; and starts the source stage&lt;/p&gt;
  66. &lt;/li&gt;
  67. &lt;li&gt;
  68. &lt;p&gt;A CloudWatch Event Rule is triggered by the stage change to &amp;#39;STARTED&amp;#39;&lt;/p&gt;
  69. &lt;/li&gt;
  70. &lt;li&gt;
  71. &lt;p&gt;The event rule triggers AWS CodeBuild and submits the pipeline name&lt;/p&gt;
  72. &lt;/li&gt;
  73. &lt;li&gt;
  74. &lt;p&gt;AWS CodeBuild polls the source stage job details and acknowledges the job&lt;/p&gt;
  75. &lt;/li&gt;
  76. &lt;li&gt;
  77. &lt;p&gt;The SSH key is received by CodeBuild from the AWS Secrets Manager&lt;/p&gt;
  78. &lt;/li&gt;
  79. &lt;/ol&gt;
  80. &lt;/div&gt;
  81. &lt;div class=&#34;paragraph&#34;&gt;
  82. &lt;p&gt;&lt;br/&gt;
  83.  
  84. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;a) Successful builds&lt;/span&gt;
  85. &lt;/p&gt;
  86. &lt;/div&gt;
  87. &lt;div class=&#34;olist arabic&#34;&gt;
  88. &lt;ol class=&#34;arabic&#34; start=&#34;10&#34;&gt;
  89. &lt;li&gt;
  90. &lt;p&gt;a) CodeBuild uploads the zipped artifact to the S3 artifact bucket&lt;/p&gt;
  91. &lt;/li&gt;
  92. &lt;li&gt;
  93. &lt;p&gt;a) CodeBuild puts the source stage into &amp;#39;Succeeded&amp;#39;&lt;/p&gt;
  94. &lt;/li&gt;
  95. &lt;li&gt;
  96. &lt;p&gt;a) CodePipeline executes the next stage&lt;br/&gt;&lt;/p&gt;
  97. &lt;/li&gt;
  98. &lt;/ol&gt;
  99. &lt;/div&gt;
  100. &lt;div class=&#34;paragraph&#34;&gt;
  101. &lt;p&gt;&lt;br/&gt;
  102.  
  103. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;b) Failed builds&lt;/span&gt;
  104. &lt;/p&gt;
  105. &lt;/div&gt;
  106. &lt;div class=&#34;olist arabic&#34;&gt;
  107. &lt;ol class=&#34;arabic&#34; start=&#34;10&#34;&gt;
  108. &lt;li&gt;
  109. &lt;p&gt;b) A CloudWatch Event Rule is triggered by the state change to &amp;#39;FAILED&amp;#39;&lt;/p&gt;
  110. &lt;/li&gt;
  111. &lt;li&gt;
  112. &lt;p&gt;b) The event rule triggers a Lambda function and provides pipeline execution/job details&lt;/p&gt;
  113. &lt;/li&gt;
  114. &lt;li&gt;
  115. &lt;p&gt;b) Depending where the CodeBuild process failed the source stage is put into &amp;#39;Failed&amp;#39; or the pipeline execution is stopped/abandoned&lt;/p&gt;
  116. &lt;/li&gt;
  117. &lt;/ol&gt;
  118. &lt;/div&gt;
  119. &lt;hr/&gt;
  120. &lt;div class=&#34;paragraph&#34;&gt;
  121. &lt;p&gt;As you can see the solution is very similar, but we omit a long running Lambda function and put all the logic into CodeBuild. We only need a short running Lambda function for error handling. Whenever CodeBuild fails we interconnect this Lambda function and CodeBuild through a CloudWatch Event Rule.&lt;/p&gt;
  122. &lt;/div&gt;
  123. &lt;div class=&#34;paragraph&#34;&gt;
  124. &lt;p&gt;But let’s do a deep dive into the different parts of the solution.
  125. Again, you will find  the complete example in my  &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/tree/master/Azure_CodePipeline_Source&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;AWS_Cloudformation_Examples Github&lt;/a&gt; Repo.&lt;br/&gt;&lt;/p&gt;
  126. &lt;/div&gt;
  127. &lt;hr/&gt;
  128. &lt;h3 id=&#34;_webhooks&#34; class=&#34;discrete&#34;&gt;Webhooks&lt;/h3&gt;
  129. &lt;div class=&#34;paragraph&#34;&gt;
  130. &lt;p&gt;This part of the solution is pretty straightforward and almost the same configuration for all the different third-party Git repository providers.&lt;br/&gt;
  131. You will find the CloudFormation code for the CodePipeline webhook in &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/Azure_CodePipeline_Source/AzureDevopsPipeline.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;AzureDevopsPipeline.yaml&lt;/a&gt;.&lt;br/&gt;
  132. Let’s look at the Azure DevOps specific parts of the webhook:&lt;/p&gt;
  133. &lt;/div&gt;
  134. &lt;div class=&#34;paragraph&#34;&gt;
  135. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;120&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Webhook&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  136. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;121&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;AWS::CodePipeline::Webhook&amp;#39;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  137. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;122&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Properties&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  138. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;123&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;AuthenticationConfiguration&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;{}&lt;span class=&#34;w&#34;&gt;
  139. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;124&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Filters&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  140. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line hl&#34;&gt;&lt;span class=&#34;ln&#34;&gt;125&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;JsonPath&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;$.resource.refUpdates..name&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  141. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;126&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;MatchEquals&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub &amp;#39;refs/heads/${Branch}&amp;#39;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  142. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;127&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Authentication&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;UNAUTHENTICATED&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  143. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;128&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;TargetPipeline&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Ref AppPipeline&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  144. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;129&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;TargetAction&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Source&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  145. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;130&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub AzureDevopsHook-${AWS::StackName}&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  146. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;131&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;TargetPipelineVersion&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub ${AppPipeline.Version}&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  147. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;132&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RegisterWithThirdParty&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;False&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  148. &lt;/div&gt;
  149. &lt;div class=&#34;paragraph&#34;&gt;
  150. &lt;p&gt;If we look at &lt;code&gt;line 125&lt;/code&gt; we see the JSON Path which will be used to find the branch of the Repo which triggered the Azure DevOps branch. For most third-party Git repositories this path equals to
  151. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;&amp;#39;$.ref&amp;#39;&lt;/span&gt;
  152. but the structure of the request generated by the Azure DevOps Webhook looks different and we will find the branch using
  153. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;&amp;#39;$.resource.refUpdates..name&amp;#39;&lt;/span&gt;
  154. as JSON path.&lt;br/&gt;
  155. Almost every third-party Git repository provider gives you access to the history of webhook executions and you will find the complete requests there. So, whenever you try to integrate a third-party provider look at the webhook requests first and define the correct JSON path for your branch filter.&lt;br/&gt;
  156. This filter will now be used to decide if the branch which triggered the AzureDevops Webhook is the one we are using in our Source Stage definition of our pipeline and will trigger the CodePipeline execution (step 4).&lt;/p&gt;
  157. &lt;/div&gt;
  158. &lt;hr/&gt;
  159. &lt;h3 id=&#34;_codepipeline_customactiontype&#34; class=&#34;discrete&#34;&gt;CodePipeline CustomActionType&lt;/h3&gt;
  160. &lt;div class=&#34;paragraph&#34;&gt;
  161. &lt;p&gt;The CustomActionType for the CodePipeline Source Stage will be created by the &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/Azure_CodePipeline_Source/AzureDevopsPreReqs.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;AzureDevopsPreReqs.yaml&lt;/a&gt; CloudFormation template:&lt;br/&gt;&lt;/p&gt;
  162. &lt;/div&gt;
  163. &lt;div class=&#34;paragraph&#34;&gt;
  164. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;11&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;AzureDevopsActionType&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  165. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;12&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;AWS::CodePipeline::CustomActionType&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  166. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;13&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Properties&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  167. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;14&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Category&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Source&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  168. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;15&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Provider&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;AzureDevOpsRepo&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  169. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;16&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Version&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;1&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  170. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;17&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ConfigurationProperties&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  171. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;18&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;-&lt;span class=&#34;w&#34;&gt;
  172. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;19&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Description&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;The name of the MS Azure DevOps Organization&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  173. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;20&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Key&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;false&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  174. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;21&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Organization&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  175. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;22&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Queryable&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;false&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  176. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;23&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Required&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;true&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  177. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;24&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Secret&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;false&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  178. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;25&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;String&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  179. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;26&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;-&lt;span class=&#34;w&#34;&gt;
  180. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;27&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Description&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;The name of the repository&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  181. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;28&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Key&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;true&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  182. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;29&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Repo&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  183. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;30&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Queryable&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;false&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  184. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;31&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Required&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;true&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  185. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;32&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Secret&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;false&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  186. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;33&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;String&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  187. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;34&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;-&lt;span class=&#34;w&#34;&gt;
  188. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;35&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Description&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;The name of the project&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  189. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;36&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Key&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;false&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  190. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;37&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Project&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  191. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;38&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Queryable&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;false&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  192. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;39&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Required&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;true&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  193. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;40&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Secret&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;false&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  194. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;41&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;String&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  195. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;42&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;-&lt;span class=&#34;w&#34;&gt;
  196. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;43&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Description&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;The tracked branch&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  197. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;44&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Key&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;false&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  198. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;45&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Branch&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  199. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;46&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Queryable&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;false&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  200. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;47&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Required&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;true&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  201. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;48&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Secret&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;false&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  202. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;49&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;String&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  203. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;50&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;-&lt;span class=&#34;w&#34;&gt;
  204. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;51&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Description&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;The name of the CodePipeline&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  205. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;52&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Key&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;false&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  206. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;53&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;PipelineName&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  207. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;54&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Queryable&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;true&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  208. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;55&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Required&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;true&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  209. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;56&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Secret&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;false&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  210. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;57&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;String&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  211. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;58&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;InputArtifactDetails&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  212. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;59&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;MaximumCount&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;m&#34;&gt;0&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  213. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;60&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;MinimumCount&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;m&#34;&gt;0&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  214. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;61&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;OutputArtifactDetails&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  215. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;62&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;MaximumCount&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;m&#34;&gt;1&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  216. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;63&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;MinimumCount&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;m&#34;&gt;1&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  217. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;64&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Settings&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  218. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;65&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;EntityUrlTemplate&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;https://dev.azure.com/{Config:Organization}/{Config:Project}/_git/{Config:Repo}?version=GB{Config:Branch}&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  219. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;66&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ExecutionUrlTemplate&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;https://dev.azure.com/{Config:Organization}/{Config:Project}/_git/{Config:Repo}?version=GB{Config:Branch}&amp;#34;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  220. &lt;/div&gt;
  221. &lt;div class=&#34;paragraph&#34;&gt;
  222. &lt;p&gt;Large parts of the code are self-explanatory.&lt;br/&gt;&lt;/p&gt;
  223. &lt;/div&gt;
  224. &lt;div class=&#34;paragraph&#34;&gt;
  225. &lt;p&gt;We need the Azure DevOps
  226. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;Organization, Project, Reponame and Branch&lt;/span&gt;
  227. to git clone the required repo branch.&lt;br/&gt;
  228. All these properties are must fields and as you can see are sufficient to create a back link to the Project in Azure DevOps as seen on &lt;code&gt;line 65&lt;/code&gt;.&lt;br/&gt;&lt;/p&gt;
  229. &lt;/div&gt;
  230. &lt;div class=&#34;paragraph&#34;&gt;
  231. &lt;p&gt;The property
  232. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;PipelineName&lt;/span&gt;
  233. isn’t needed to get the Git repo but will be used to identify the correct CodePipeline job which should be processed. Therefore, this property has to be query able, otherwise you will get an error later on when using the query-param parameter on &lt;code&gt;line 148&lt;/code&gt; (had to find out this the hard way).&lt;/p&gt;
  234. &lt;/div&gt;
  235. &lt;hr/&gt;
  236. &lt;h3 id=&#34;_cloudwatch_events_rules&#34; class=&#34;discrete&#34;&gt;CloudWatch Events Rules&lt;/h3&gt;
  237. &lt;div class=&#34;paragraph&#34;&gt;
  238. &lt;p&gt;This part is found in the  &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/Azure_CodePipeline_Source/AzureDevopsPreReqs.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;AzureDevopsPreReqs.yaml&lt;/a&gt; CloudFormation template as well:&lt;br/&gt;&lt;/p&gt;
  239. &lt;/div&gt;
  240. &lt;div class=&#34;paragraph&#34;&gt;
  241. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;210&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;CloudWatchEventRule&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  242. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;211&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;AWS::Events::Rule&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  243. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;212&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Properties&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  244. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;213&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;EventPattern&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  245. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;214&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;source&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  246. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;215&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;aws.codepipeline&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  247. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;216&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;detail-type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  248. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;217&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;- &lt;span class=&#34;s1&#34;&gt;&amp;#39;CodePipeline Action Execution State Change&amp;#39;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  249. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;218&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;detail&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  250. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;219&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;state&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  251. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;220&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;STARTED&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  252. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;221&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  253. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;222&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;provider&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  254. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;223&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;AzureDevOpsRepo&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  255. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;224&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Targets&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  256. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;225&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;-&lt;span class=&#34;w&#34;&gt;
  257. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;226&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Arn&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub ${BuildProject.Arn}&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  258. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;227&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Id&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;triggerjobworker&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  259. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;228&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RoleArn&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub ${CloudWatchEventRole.Arn}&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  260. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;229&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;InputTransformer&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  261. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;230&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;InputPathsMap&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;{&lt;span class=&#34;s2&#34;&gt;&amp;#34;executionid&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;$.detail.execution-id&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;pipelinename&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;$.detail.pipeline&amp;#34;&lt;/span&gt;}&lt;span class=&#34;w&#34;&gt;
  262. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;231&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;InputTemplate&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;&amp;#34;{\&amp;#34;environmentVariablesOverride\&amp;#34;: [{\&amp;#34;name\&amp;#34;: \&amp;#34;executionid\&amp;#34;, \&amp;#34;type\&amp;#34;: \&amp;#34;PLAINTEXT\&amp;#34;, \&amp;#34;value\&amp;#34;: &amp;lt;executionid&amp;gt;},{\&amp;#34;name\&amp;#34;: \&amp;#34;pipelinename\&amp;#34;, \&amp;#34;type\&amp;#34;: \&amp;#34;PLAINTEXT\&amp;#34;, \&amp;#34;value\&amp;#34;: &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;&amp;lt;executionid&amp;gt;}]}&amp;#34;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  263. &lt;/div&gt;
  264. &lt;div class=&#34;paragraph&#34;&gt;
  265. &lt;p&gt;I only want to draw your attention to &lt;code&gt;lines 125-126&lt;/code&gt; where the event input will be transformed to an output which later will be used by CodeBuild (step 7).&lt;br/&gt;&lt;/p&gt;
  266. &lt;/div&gt;
  267. &lt;div class=&#34;paragraph&#34;&gt;
  268. &lt;p&gt;We will hand over two CodeBuild environment variables,
  269. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;executionid&lt;/span&gt;
  270. and
  271. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;pipelinename&lt;/span&gt;
  272. . Creating the &lt;code&gt;InputTemplate&lt;/code&gt; was challenging, as you can see you have to carefully escape all double quotes and you have to override the CodeBuild environment variables.&lt;br/&gt;&lt;/p&gt;
  273. &lt;/div&gt;
  274. &lt;div class=&#34;paragraph&#34;&gt;
  275. &lt;p&gt;Fortunately the &lt;a href=&#34;https://docs.aws.amazon.com/codebuild/latest/APIReference/API_StartBuild.html&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;API Reference Guide for AWS CodeBuild&lt;/a&gt; is very well documented and you find the needed request syntax there → use &lt;code&gt;environmentVariablesOverride&lt;/code&gt; and provide an array of &lt;a href=&#34;https://docs.aws.amazon.com/codebuild/latest/APIReference/API_EnvironmentVariable.html&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;EnvironmentVariable objects&lt;/a&gt;, in this case
  276. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;executionid&lt;/span&gt;
  277. and
  278. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;pipelinename&lt;/span&gt;
  279. .
  280. &lt;br/&gt;
  281. &lt;br/&gt;
  282. &lt;br/&gt;
  283. Now let’s look at the second CloudWatch Event Rule which will be triggered if CodeBuild fails (step 10b):&lt;br/&gt;&lt;/p&gt;
  284. &lt;/div&gt;
  285. &lt;div class=&#34;paragraph&#34;&gt;
  286. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;232&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;CloudWatchEventRuleBuildFailed&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  287. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;233&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;AWS::Events::Rule&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  288. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;234&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Properties&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  289. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;235&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;EventPattern&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  290. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;236&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;source&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  291. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;237&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;aws.codebuild&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  292. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;238&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;detail-type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  293. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;239&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;- &lt;span class=&#34;s1&#34;&gt;&amp;#39;CodeBuild Build State Change&amp;#39;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  294. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;240&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;detail&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  295. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;241&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;build-status&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  296. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;242&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;FAILED&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  297. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;243&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;project-name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  298. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;244&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub ${AWS::StackName}-GetAzureDevOps-Repo&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  299. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;245&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Targets&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  300. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;246&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;-&lt;span class=&#34;w&#34;&gt;
  301. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;247&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Arn&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub ${LambdaCodeBuildFails.Arn}&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  302. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;248&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Id&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;failtrigger&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  303. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;249&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;InputTransformer&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  304. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;250&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;InputPathsMap&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;{&lt;span class=&#34;s2&#34;&gt;&amp;#34;loglink&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;$.detail.additional-information.logs.deep-link&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;environment-variables&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;$.detail.additional-information.environment.environment-variables&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;exported-environment-variables&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;$.detail.additional-information.exported-environment-variables&amp;#34;&lt;/span&gt;}&lt;span class=&#34;w&#34;&gt;
  305. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;251&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;InputTemplate&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;&amp;#34;{\&amp;#34;loglink\&amp;#34;: &amp;lt;loglink&amp;gt;, \&amp;#34;environment-variables\&amp;#34;: &amp;lt;environment-variables&amp;gt;, \&amp;#34;exported-environment-variables\&amp;#34;: &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;&amp;lt;exported-environment-variables&amp;gt;}&amp;#34;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  306. &lt;/div&gt;
  307. &lt;div class=&#34;paragraph&#34;&gt;
  308. &lt;p&gt;Again, I want to draw your attention to the &lt;code&gt;InputPathsMap&lt;/code&gt; and &lt;code&gt;InputTemplate&lt;/code&gt; part.&lt;br/&gt;
  309. Here we extract 3 variables:&lt;/p&gt;
  310. &lt;/div&gt;
  311. &lt;div class=&#34;ulist&#34;&gt;
  312. &lt;ul&gt;
  313. &lt;li&gt;
  314. &lt;p&gt;
  315. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;loglink&lt;/span&gt;
  316. (single string value) → deeplink to the CloudWatch logs for CodeBuild execution&lt;/p&gt;
  317. &lt;/li&gt;
  318. &lt;li&gt;
  319. &lt;p&gt;
  320. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;environment-variables&lt;/span&gt;
  321. (array of objects) →
  322. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;execution_id&lt;/span&gt;
  323. and
  324. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;pipelinename&lt;/span&gt;
  325. objects&lt;/p&gt;
  326. &lt;/li&gt;
  327. &lt;li&gt;
  328. &lt;p&gt;
  329. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;exported-environment-variables&lt;/span&gt;
  330. (again array of objects) →
  331. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;jobId&lt;/span&gt;
  332. object&lt;/p&gt;
  333. &lt;/li&gt;
  334. &lt;/ul&gt;
  335. &lt;/div&gt;
  336. &lt;div class=&#34;paragraph&#34;&gt;
  337. &lt;p&gt;The &lt;code&gt;InputTemplate&lt;/code&gt; creates a simple JSON file which will be later used by the Lambda function (step 11b).&lt;/p&gt;
  338. &lt;/div&gt;
  339. &lt;hr/&gt;
  340. &lt;h3 id=&#34;_codebuild&#34; class=&#34;discrete&#34;&gt;CodeBuild&lt;/h3&gt;
  341. &lt;div class=&#34;paragraph&#34;&gt;
  342. &lt;p&gt;Most of the logic of this solution can be found in the CodeBuild project. The project will have 2 environment variables
  343. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;pipelinename&lt;/span&gt;
  344. and
  345. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;executionid&lt;/span&gt;
  346. (&lt;code&gt;lines 127-131&lt;/code&gt;) and as seen before will be pre-filled by the Webhook event (step 7).&lt;br/&gt;
  347. Now let’s get to the meat of the project, the BuildSpec part:&lt;/p&gt;
  348. &lt;/div&gt;
  349. &lt;div class=&#34;paragraph&#34;&gt;
  350. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;134&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;BuildSpec&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub |&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  351. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;135&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;version&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;m&#34;&gt;0.2&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  352. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;136&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;env&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  353. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;137&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;exported-variables&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  354. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;138&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                        &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;jobid&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  355. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;139&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;phases&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  356. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;140&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;pre_build&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  357. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;141&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;commands&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  358. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;142&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;echo $pipelinename&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  359. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;143&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;echo $executionid&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  360. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;144&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;wait_period=0&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  361. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;145&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;p&#34;&gt;|&lt;/span&gt;&lt;span class=&#34;sd&#34;&gt;
  362. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;146&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                            while true
  363. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;147&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                            do
  364. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;148&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                                jobdetail=$(aws codepipeline poll-for-jobs --action-type-id category=&amp;#34;Source&amp;#34;,owner=&amp;#34;Custom&amp;#34;,provider=&amp;#34;AzureDevOpsRepo&amp;#34;,version=&amp;#34;1&amp;#34; --query-param PipelineName=$pipelinename --max-batch-size 1)
  365. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;149&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                                provider=$(echo $jobdetail | jq &amp;#39;.jobs[0].data.actionTypeId.provider&amp;#39; -r)
  366. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;150&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                                wait_period=$(($wait_period+10))
  367. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;151&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                                if [ $provider = &amp;#34;AzureDevOpsRepo&amp;#34; ];then
  368. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;152&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                                  echo $jobdetail
  369. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;153&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                                  break
  370. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;154&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                                fi
  371. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;155&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                                if [ $wait_period -gt 300 ];then
  372. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;156&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                                  echo &amp;#34;Haven&amp;#39;t found a pipeline job for 5 minutes, will stop pipeline.&amp;#34;
  373. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;157&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                                  exit 1
  374. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;158&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                                else
  375. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;159&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                                  echo &amp;#34;No pipeline job found, will try again in 10 seconds&amp;#34;
  376. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;160&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                                  sleep 10
  377. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;161&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                                fi
  378. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;162&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                            done&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;                            
  379. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;163&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;jobid=$(echo $jobdetail | jq &amp;#39;.jobs[0].id&amp;#39; -r)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  380. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;164&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;echo $jobid&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  381. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;165&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;ack=$(aws codepipeline acknowledge-job --job-id $(echo $jobdetail | jq &amp;#39;.jobs[0].id&amp;#39; -r) --nonce $(echo $jobdetail | jq &amp;#39;.jobs[0].nonce&amp;#39; -r))&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  382. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;166&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;Branch=$(echo $jobdetail | jq &amp;#39;.jobs[0].data.actionConfiguration.configuration.Branch&amp;#39; -r)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  383. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;167&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;Organization=$(echo $jobdetail | jq &amp;#39;.jobs[0].data.actionConfiguration.configuration.Organization&amp;#39; -r)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  384. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;168&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;Repo=$(echo $jobdetail | jq &amp;#39;.jobs[0].data.actionConfiguration.configuration.Repo&amp;#39; -r)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  385. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;169&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;Project=$(echo $jobdetail | jq &amp;#39;.jobs[0].data.actionConfiguration.configuration.Project&amp;#39; -r)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  386. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;170&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;ObjectKey=$(echo $jobdetail | jq &amp;#39;.jobs[0].data.outputArtifacts[0].location.s3Location.objectKey&amp;#39; -r)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  387. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;171&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;BucketName=$(echo $jobdetail | jq &amp;#39;.jobs[0].data.outputArtifacts[0].location.s3Location.bucketName&amp;#39; -r)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  388. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;172&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;aws secretsmanager get-secret-value --secret-id ${SSHKey} --query &amp;#39;SecretString&amp;#39; --output text | base64 --decode &amp;gt; ~/.ssh/id_rsa&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  389. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;173&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;chmod 600 ~/.ssh/id_rsa&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  390. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;174&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;ssh-keygen -F ssh.dev.azure.com || ssh-keyscan ssh.dev.azure.com &amp;gt;&amp;gt;~/.ssh/known_hosts&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  391. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;175&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;build&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  392. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;176&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;commands&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  393. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;177&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;git clone &amp;#34;git@ssh.dev.azure.com:v3/$Organization/$Project/$Repo&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  394. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;178&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cd $Repo&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  395. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;179&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;git checkout $Branch&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  396. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;180&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;zip -r output_file.zip *&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  397. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;181&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;aws s3 cp output_file.zip s3://$BucketName/$ObjectKey&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  398. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;182&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                          &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;aws codepipeline put-job-success-result --job-id $(echo $jobdetail | jq &amp;#39;.jobs[0].id&amp;#39; -r)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  399. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;183&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;artifacts&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  400. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;184&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;files&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  401. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;185&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                        &lt;/span&gt;- &lt;span class=&#34;s1&#34;&gt;&amp;#39;**/*&amp;#39;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  402. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;186&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;base-directory&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;$Repo&amp;#39;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  403. &lt;/div&gt;
  404. &lt;div class=&#34;paragraph&#34;&gt;
  405. &lt;p&gt;First of all, we define a custom environment variable which will be filled with the
  406. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;jobid&lt;/span&gt;
  407. later on (&lt;code&gt;lines 136-128&lt;/code&gt;). Defining a custom environment variable for the
  408. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;jobid&lt;/span&gt;
  409. will ensure that we have a value for the
  410. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;jobid&lt;/span&gt;
  411. in the CodeBuild response (which will later be received by the CloudWatch Event Rule in case of errors).&lt;br/&gt;
  412. &lt;br/&gt;
  413. Polling CodePipeline for jobs usually needs more than one try to get a result, therefore we use a while loop and poll all 10 seconds (step 8).&lt;br/&gt;
  414. As you can see on &lt;code&gt;line 148&lt;/code&gt; we only poll for jobs with the correct
  415. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;PipelineName&lt;/span&gt;
  416. (remember that we defined this property as query able).&lt;br/&gt;
  417. If we don’t get a result within 5 minutes we will exit the CodeBuild execution with a non-zero exit code which will lead to &amp;#39;FAILED&amp;#39; state and which will trigger the CloudWatch Event Rule for errors (&lt;code&gt;lines 147-162&lt;/code&gt;).&lt;br/&gt;
  418. &lt;br/&gt;
  419. Now we acknowledge the job and we ask the CodePipeline to provide more details on the job (&lt;code&gt;lines 163-171&lt;/code&gt;, step 8):&lt;/p&gt;
  420. &lt;/div&gt;
  421. &lt;div class=&#34;ulist&#34;&gt;
  422. &lt;ul&gt;
  423. &lt;li&gt;
  424. &lt;p&gt;
  425. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;Branch, Organization, Repo, Project&lt;/span&gt;
  426. → Azure DevOps properties&lt;/p&gt;
  427. &lt;/li&gt;
  428. &lt;li&gt;
  429. &lt;p&gt;
  430. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;ObjectKey, BucketName&lt;/span&gt;
  431. → these two parameters are very essential for the next CodePipeline step&lt;/p&gt;
  432. &lt;/li&gt;
  433. &lt;/ul&gt;
  434. &lt;/div&gt;
  435. &lt;div class=&#34;paragraph&#34;&gt;
  436. &lt;p&gt;&lt;br/&gt;
  437. Before we can clone the repo we have to put the decoded base64 ssh key received from the Secrets Manager into the correct file in the CodeBuild container (step 9).&lt;br/&gt;
  438. We change the access permissions on the created key file to 600 and add the Azure DevOps public keys to the known_hosts file. (&lt;code&gt;lines 172-174&lt;/code&gt;)&lt;br/&gt;
  439. &lt;br/&gt;
  440. Now the actual build process starts, and the repo is cloned using the copied SSH key for authentication. Before zipping all the repo content, the appropriate branch is checked out and the zipped artifact is then uploaded to the artifact store (step 10a).&lt;br/&gt;&lt;/p&gt;
  441. &lt;/div&gt;
  442. &lt;div class=&#34;paragraph&#34;&gt;
  443. &lt;p&gt;Here we see again the two parameters
  444. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;ObjectKey and BucketName&lt;/span&gt;
  445. received earlier from the job details. The artifact has to use the value of
  446. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;ObjectKey&lt;/span&gt;
  447. as filepath/name and
  448. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;BucketName&lt;/span&gt;
  449. as S3 bucket name for the upload. It is very crucial to use the correct filepath/name because the next CodePipeline Step/Stage will try to download the artifact form the Artifact Bucket using these two parameters and will fail if you used wrong values during upload.&lt;br/&gt;
  450. &lt;br/&gt;
  451. Last action of the CodeBuild project is to inform the CodePipeline of a successful execution of the job (&lt;code&gt;line 182&lt;/code&gt;, step 11a).&lt;br/&gt;&lt;/p&gt;
  452. &lt;/div&gt;
  453. &lt;hr/&gt;
  454. &lt;h3 id=&#34;_lambda_function&#34; class=&#34;discrete&#34;&gt;Lambda Function&lt;/h3&gt;
  455. &lt;div class=&#34;paragraph&#34;&gt;
  456. &lt;p&gt;The Lambda function will only be used for error handling. The logic is pretty simple as you can see here:&lt;/p&gt;
  457. &lt;/div&gt;
  458. &lt;div class=&#34;paragraph&#34;&gt;
  459. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-python&#34; data-lang=&#34;python&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;338&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;          &lt;span class=&#34;k&#34;&gt;def&lt;/span&gt; &lt;span class=&#34;nf&#34;&gt;lambda_handler&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;event&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;context&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;):&lt;/span&gt;
  460. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;339&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;              &lt;span class=&#34;n&#34;&gt;LOGGER&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;info&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;event&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  461. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;340&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;              &lt;span class=&#34;k&#34;&gt;try&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;
  462. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;341&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;n&#34;&gt;job_id&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;event&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;[&lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;exported-environment-variables&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;][&lt;/span&gt;&lt;span class=&#34;mi&#34;&gt;0&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;][&lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;value&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;]&lt;/span&gt;
  463. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;342&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;nb&#34;&gt;print&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;job_id&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  464. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;343&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;n&#34;&gt;execution_id&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;event&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;[&lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;environment-variables&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;][&lt;/span&gt;&lt;span class=&#34;mi&#34;&gt;0&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;][&lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;value&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;]&lt;/span&gt;
  465. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;344&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;nb&#34;&gt;print&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;execution_id&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  466. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;345&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;n&#34;&gt;pipelinename&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;event&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;[&lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;environment-variables&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;][&lt;/span&gt;&lt;span class=&#34;mi&#34;&gt;1&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;][&lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;value&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;]&lt;/span&gt;
  467. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;346&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;nb&#34;&gt;print&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;pipelinename&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  468. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;347&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;n&#34;&gt;loglink&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;event&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;[&lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;loglink&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;]&lt;/span&gt;
  469. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;348&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;nb&#34;&gt;print&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;loglink&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  470. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;349&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;k&#34;&gt;if&lt;/span&gt; &lt;span class=&#34;p&#34;&gt;(&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;job_id&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;!=&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;&amp;#34;&lt;/span&gt; &lt;span class=&#34;p&#34;&gt;)&lt;/span&gt; &lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;
  471. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;350&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                      &lt;span class=&#34;nb&#34;&gt;print&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;Found an job id&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  472. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;351&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                      &lt;span class=&#34;n&#34;&gt;codepipeline_failure&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;job_id&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;CodeBuild process failed&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;loglink&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  473. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;352&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;k&#34;&gt;else&lt;/span&gt; &lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;
  474. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;353&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                      &lt;span class=&#34;nb&#34;&gt;print&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;Found NO job id&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  475. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;354&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                      &lt;span class=&#34;n&#34;&gt;codepipeline_stop&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;execution_id&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;CodeBuild process failed&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;pipelinename&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  476. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;355&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;              &lt;span class=&#34;k&#34;&gt;except&lt;/span&gt; &lt;span class=&#34;ne&#34;&gt;KeyError&lt;/span&gt; &lt;span class=&#34;k&#34;&gt;as&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;err&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;
  477. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;356&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;n&#34;&gt;LOGGER&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;error&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;Could not retrieve CodePipeline Job ID!&lt;/span&gt;&lt;span class=&#34;se&#34;&gt;\n&lt;/span&gt;&lt;span class=&#34;si&#34;&gt;%s&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;err&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;pipelinename&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  478. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;357&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;k&#34;&gt;return&lt;/span&gt; &lt;span class=&#34;kc&#34;&gt;False&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  479. &lt;/div&gt;
  480. &lt;div class=&#34;paragraph&#34;&gt;
  481. &lt;p&gt;First we get all variable values which were provided by the CloudWatch Event Rule and then we only check if there is a value for
  482. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;job_id&lt;/span&gt;
  483. .&lt;br/&gt;
  484. &lt;br/&gt;
  485. If there is a value we will trigger the &lt;code&gt;codepipeline_failure&lt;/code&gt; function which then will inform CodePipeline of a failure result of this job (&lt;code&gt;lines 312-323&lt;/code&gt;).&lt;br/&gt;
  486. Whenever CodeBuild fails without getting a
  487. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;job_id&lt;/span&gt;
  488. before the error occurs the Lambda function will call the &lt;code&gt;codepipeline_stop&lt;/code&gt; part. The
  489. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;execution_id&lt;/span&gt;
  490. and
  491. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;pipelinename&lt;/span&gt;
  492. is then used to stop and abandon the correct CodePipeline execution (&lt;code&gt;lines 324-337&lt;/code&gt;).&lt;/p&gt;
  493. &lt;/div&gt;
  494. &lt;hr/&gt;
  495. &lt;h2 id=&#34;_summary&#34; class=&#34;discrete&#34;&gt;Summary&lt;/h2&gt;
  496. &lt;div class=&#34;paragraph&#34;&gt;
  497. &lt;p&gt;I hope this post showed you how you can create your own CodePipeline sources and how the different parts of such a solution are playing together. This was my first time creating a custom CodePipeline source and I’m fascinated how powerful this is. You may include completely different sources into your CodePipelines, not limited to Repos at all. Wherever you have a solution which can trigger a Webhook and provide some input you are fine to use it as your own CodePipeline source.
  498. &lt;br/&gt;
  499. &lt;br/&gt;
  500. &lt;br/&gt;&lt;/p&gt;
  501. &lt;/div&gt;
  502. </description>
  503.    </item>
  504.    
  505.    <item>
  506.      <title>AWS Step Functions as CloudFormation Custom Resources - Automatic Certificate Creation Across AWS Accounts</title>
  507.      <link>https://kbild.ch/blog/2020-6-10-custom_resource_certificate_creation/</link>
  508.      <pubDate>Fri, 24 Jul 2020 13:00:00 +0200</pubDate>
  509.      
  510.      <guid>https://kbild.ch/blog/2020-6-10-custom_resource_certificate_creation/</guid>
  511. <description>&lt;div class=&#34;paragraph&#34;&gt;
  512. &lt;p&gt;Last year I wrote a CloudFormation example which deployed a &lt;a href=&#34;https://kbild.ch/blog/2019-02-25-pipeline_cloudformation/&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;CodePipeline for the Hugo CMS&lt;/a&gt;.
  513. This was an almost fully automated solution for a Hugo deployment, the only manual step was to create the needed certificate with the Amazon Certificate Manager.&lt;/p&gt;
  514. &lt;/div&gt;
  515. &lt;div class=&#34;paragraph&#34;&gt;
  516. &lt;p&gt;&lt;br/&gt;
  517. Some weeks ago AWS added the possibility of fully automated &lt;a href=&#34;https://aws.amazon.com/blogs/security/how-to-use-aws-certificate-manager-with-aws-cloudformation/&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;certificate creation via CloudFormation&lt;/a&gt; if you add the HostedZoneId to your CloudFormation certificate resource.&lt;/p&gt;
  518. &lt;/div&gt;
  519. &lt;div class=&#34;paragraph&#34;&gt;
  520. &lt;p&gt;&lt;br/&gt;
  521. This solution is neat but will not work on our company accounts because we have all Route 53 DNS Zones in a different AWS account.
  522. Therefore I needed a solution which works fully automated across different AWS accounts.&lt;/p&gt;
  523. &lt;/div&gt;
  524. &lt;div class=&#34;paragraph&#34;&gt;
  525. &lt;p&gt;&lt;br/&gt;
  526. Searching for examples gave me a good starting point to create my own solution, a custom CloudFormation resource.
  527. Here are some examples which will help you to understand custom CloudFormation resources:&lt;/p&gt;
  528. &lt;/div&gt;
  529. &lt;div class=&#34;paragraph&#34;&gt;
  530. &lt;p&gt;&lt;a href=&#34;https://www.cloudar.be/awsblog/validate-acm-certificates-in-cloudformation&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;Validate ACM certificates in Cloudformation&lt;/a&gt;&lt;/p&gt;
  531. &lt;/div&gt;
  532. &lt;div class=&#34;paragraph&#34;&gt;
  533. &lt;p&gt;&lt;a href=&#34;https://github.com/binxio/cfn-certificate-provider&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;Custom Certificate Provider with DNS validation support&lt;/a&gt;&lt;/p&gt;
  534. &lt;/div&gt;
  535. &lt;div class=&#34;paragraph&#34;&gt;
  536. &lt;p&gt;&lt;a href=&#34;https://www.dwolla.com/updates/certificate-validator/&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;Automatic Certificate Validation with Certificate Validator&lt;/a&gt;&lt;/p&gt;
  537. &lt;/div&gt;
  538. &lt;div class=&#34;paragraph&#34;&gt;
  539. &lt;p&gt;&lt;br/&gt;
  540. All these examples work perfectly and can be easily modified to work across different AWS accounts but the fact that they use long running Lambda Functions didn’t satisfy me.&lt;br/&gt;
  541. Occasionally executing long running Lambda Functions doesn’t cost much but nevertheless I always prefer short running ones and to use AWS Step Functions for the Workflow logic combined with Lambda Functions with a single purpose.&lt;/p&gt;
  542. &lt;/div&gt;
  543. &lt;div class=&#34;paragraph&#34;&gt;
  544. &lt;p&gt;&lt;br/&gt;&lt;/p&gt;
  545. &lt;/div&gt;
  546. &lt;hr/&gt;
  547. &lt;div class=&#34;paragraph&#34;&gt;
  548. &lt;p&gt;Challenge accepted, let’s create a CloudFormation Custom Resource which will work with Step Functions.&lt;/p&gt;
  549. &lt;/div&gt;
  550. &lt;hr/&gt;
  551. &lt;div class=&#34;paragraph&#34;&gt;
  552. &lt;p&gt;&lt;br/&gt;
  553. Unfortunately only &lt;strong&gt;Lambda Functions&lt;/strong&gt; or &lt;strong&gt;SNS topics&lt;/strong&gt; may be used as Custom Resource in CloudFormation, so we first have to create a Lambda Function which can be used as Custom Resource in CloudFormation and which interconnects CloudFormation with our Step Functions.&lt;br/&gt;
  554. &lt;br/&gt;&lt;/p&gt;
  555. &lt;/div&gt;
  556. &lt;div class=&#34;imageblock&#34;&gt;
  557. &lt;div class=&#34;content&#34;&gt;
  558. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/202006/CF_Custom_Resource.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/202006/CF_Custom_Resource.png&#34; alt=&#34;SolutionOverview&#34;/&gt;&lt;/a&gt;
  559. &lt;/div&gt;
  560. &lt;/div&gt;
  561. &lt;div class=&#34;paragraph&#34;&gt;
  562. &lt;p&gt;&lt;br/&gt;
  563. We have 3 components:&lt;/p&gt;
  564. &lt;/div&gt;
  565. &lt;div class=&#34;ulist&#34;&gt;
  566. &lt;ul&gt;
  567. &lt;li&gt;
  568. &lt;p&gt;&lt;strong&gt;CustomResourceCertificate&lt;/strong&gt; → The custom resource in the CloudFormation template&lt;/p&gt;
  569. &lt;/li&gt;
  570. &lt;li&gt;
  571. &lt;p&gt;&lt;strong&gt;LambdaCallStateMachine&lt;/strong&gt; → The Lambda Function which will be triggered by the CloudFormation custom resource and which will call the Step Functions&lt;/p&gt;
  572. &lt;/li&gt;
  573. &lt;li&gt;
  574. &lt;p&gt;&lt;strong&gt;CertificateStateMachine&lt;/strong&gt; → The actual Step Functions which consists of some logic and Lambda Functions&lt;/p&gt;
  575. &lt;/li&gt;
  576. &lt;/ul&gt;
  577. &lt;/div&gt;
  578. &lt;div class=&#34;paragraph&#34;&gt;
  579. &lt;p&gt;&lt;br/&gt;&lt;/p&gt;
  580. &lt;/div&gt;
  581. &lt;hr/&gt;
  582. &lt;div class=&#34;paragraph&#34;&gt;
  583. &lt;p&gt;You will find all the examples explained below in this &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/tree/master/stepFunctionCertCreation&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;AWS_Cloudformation_Examples Github&lt;/a&gt; Repo.&lt;br/&gt;&lt;/p&gt;
  584. &lt;/div&gt;
  585. &lt;div class=&#34;paragraph&#34;&gt;
  586. &lt;p&gt;The Custom Resource including &lt;strong&gt;CertificateStateMachine&lt;/strong&gt; Step Functions with all Lambda Functions and Roles/Policies can be found in the &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/stepFunctionCertCreation/certificate_xaccount_customresource.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;certificate_xaccount_customresource.yaml&lt;/a&gt;&lt;br/&gt;
  587. CloudFormation template.&lt;/p&gt;
  588. &lt;/div&gt;
  589. &lt;hr/&gt;
  590. &lt;h3 id=&#34;_certificatestatemachine&#34; class=&#34;discrete&#34;&gt;CertificateStateMachine&lt;/h3&gt;
  591. &lt;div class=&#34;paragraph&#34;&gt;
  592. &lt;p&gt;Most of the work is done by the Step Functions called &lt;strong&gt;CertificateStateMachine&lt;/strong&gt;:&lt;/p&gt;
  593. &lt;/div&gt;
  594. &lt;div class=&#34;imageblock&#34;&gt;
  595. &lt;div class=&#34;content&#34;&gt;
  596. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/202006/stepfunctions_graph.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/202006/stepfunctions_graph.png&#34; alt=&#34;CertificateStateMachine&#34; width=&#34;800&#34; height=&#34;622&#34;/&gt;&lt;/a&gt;
  597. &lt;/div&gt;
  598. &lt;/div&gt;
  599. &lt;div class=&#34;paragraph&#34;&gt;
  600. &lt;p&gt;&lt;br/&gt;
  601. &lt;strong&gt;CertificateStateMachine&lt;/strong&gt; starts with a
  602. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;Choice Action&lt;/span&gt;
  603. and if you look at the CloudFormation template which creates this Step Functions you see that the variable &lt;code&gt;$.RequestType&lt;/code&gt; is used as switch. This variable is sent by AWS CloudFormation and will give us the information if this is a &lt;code&gt;Create&lt;/code&gt;, &lt;code&gt;Update&lt;/code&gt; or &lt;code&gt;Delete&lt;/code&gt; request.&lt;br/&gt;&lt;/p&gt;
  604. &lt;/div&gt;
  605. &lt;h4 id=&#34;_create_or_update_path&#34; class=&#34;discrete&#34;&gt;Create or Update Path&lt;/h4&gt;
  606. &lt;div class=&#34;paragraph&#34;&gt;
  607. &lt;p&gt;Following the &lt;code&gt;Create&lt;/code&gt; or &lt;code&gt;Update&lt;/code&gt; path will first call the
  608. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;Create&lt;/span&gt;
  609. step which triggers a Lamba Function called &lt;strong&gt;LambdaCreateCertificateRequest&lt;/strong&gt;. As the name suggests this simple Function calls ACM and requests to create a certificate. We use the parameters &lt;code&gt;HostedZoneId&lt;/code&gt;, &lt;code&gt;WebSiteURL&lt;/code&gt; and &lt;code&gt;Region&lt;/code&gt; which we will get from &lt;strong&gt;CustomResourceCertificate&lt;/strong&gt; whenever this Custom Resource is used in a CloudFormation template&lt;br/&gt;
  610. → find more details later in this post&lt;br/&gt;
  611. As response we will get the &lt;code&gt;CertificateArn&lt;/code&gt; which we will need in the next steps.&lt;br/&gt;
  612. &lt;br/&gt;&lt;/p&gt;
  613. &lt;/div&gt;
  614. &lt;div class=&#34;paragraph&#34;&gt;
  615. &lt;p&gt;After
  616. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;Wait_10_seconds&lt;/span&gt;
  617. another Lambda Function &lt;strong&gt;LambdaDescribeCertificateRequest&lt;/strong&gt; is called in step
  618. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;DescribeCert&lt;/span&gt;
  619. . This function takes the &lt;code&gt;CertificateArn&lt;/code&gt; as input and calls ACM again to get the needed DNS &lt;code&gt;CNAME entries&lt;/code&gt; for the validation and the &lt;code&gt;ValidationStatus&lt;/code&gt;.&lt;br/&gt;
  620. &lt;br/&gt;&lt;/p&gt;
  621. &lt;/div&gt;
  622. &lt;div class=&#34;paragraph&#34;&gt;
  623. &lt;p&gt;
  624. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;CreateDNS&lt;/span&gt;
  625. triggers &lt;strong&gt;LambdaCreateDNSEntry&lt;/strong&gt; Lambda Function and takes the CNAME entries as input. Here the magic for the cross account creation happens. The Lambda Function will use the ARN of the Role which is created in our Route 53 Domain AWS Account and will call Route 53 to create the DNS Record Set.&lt;br/&gt;
  626. &lt;br/&gt;&lt;/p&gt;
  627. &lt;/div&gt;
  628. &lt;div class=&#34;paragraph&#34;&gt;
  629. &lt;p&gt;
  630. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;CheckCert&lt;/span&gt;
  631. will again use &lt;strong&gt;LambdaDescribeCertificateRequest&lt;/strong&gt; to get the ValidationStatus of the Cert creation.
  632.  
  633. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;Cert Ready?&lt;/span&gt;
  634. will loop using
  635. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;Wait_100_seconds_for_certificate&lt;/span&gt;
  636.  until the &lt;code&gt;ValidationStatus&lt;/code&gt; equals &lt;code&gt;SUCCESS&lt;/code&gt;&lt;br/&gt;
  637. &lt;br/&gt;&lt;/p&gt;
  638. &lt;/div&gt;
  639. &lt;div class=&#34;paragraph&#34;&gt;
  640. &lt;p&gt;Last Step
  641. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;SendResultCreation&lt;/span&gt;
  642. calls the Lambda Function &lt;strong&gt;LambdaSendResult&lt;/strong&gt;. This Function returns a success response to AWS CloudFormation via the &lt;a href=&#34;https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-lambda-function-code-cfnresponsemodule.html&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;cfn-response&lt;/a&gt; module. This module knows the AWS CloudFormation Endpoint for the response through the variable &lt;code&gt;responseUrl&lt;/code&gt;. This variable is provided when AWS CloudFormation calls the ServiceToken of the Custom Resource.&lt;br/&gt;
  643. The &lt;code&gt;CertificateArn&lt;/code&gt; is used as &lt;code&gt;physicalResourceId&lt;/code&gt; for the Custom Resource, so this will be the Return value of the Custom Resource.
  644. &lt;br/&gt;&lt;/p&gt;
  645. &lt;/div&gt;
  646. &lt;h4 id=&#34;_delete_path&#34; class=&#34;discrete&#34;&gt;Delete Path&lt;/h4&gt;
  647. &lt;div class=&#34;paragraph&#34;&gt;
  648. &lt;p&gt;The &lt;code&gt;Delete&lt;/code&gt; Path starts with the Lambda Function &lt;strong&gt;LambdaDescribeCertificateRequest&lt;/strong&gt; in step
  649. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;DescribeCertDeletion&lt;/span&gt;
  650. . In contrast to the use of the same Function in the Create Path the CertificateArn is provided via the variable &lt;code&gt;PhysicalResourceId&lt;/code&gt;. The response includes the DNS &lt;code&gt;CNAME entries&lt;/code&gt; which were used for the validation.&lt;br/&gt;
  651. &lt;br/&gt;&lt;/p&gt;
  652. &lt;/div&gt;
  653. &lt;div class=&#34;paragraph&#34;&gt;
  654. &lt;p&gt;
  655. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;Delete&lt;/span&gt;
  656. step will call the Lambda Function &lt;strong&gt;LambdaDeleteResource&lt;/strong&gt;. This Function will first delete the DNS Entries in our Route 53 Domain AWS Account, again done via assuming a Role in this Account. Second the Function deletes the according Certificate in ACM.&lt;br/&gt;
  657. &lt;br/&gt;&lt;/p&gt;
  658. &lt;/div&gt;
  659. &lt;div class=&#34;paragraph&#34;&gt;
  660. &lt;p&gt;Last Step
  661. &lt;span style=&#34;background-color:;color:#f37e26;&#34;&gt;SendResultDeletion&lt;/span&gt;
  662. calls the Lambda Function &lt;strong&gt;LambdaSendResult&lt;/strong&gt; and returns a success response to AWS CloudFormation equal to the use in the Create Path.&lt;br/&gt;
  663. &lt;br/&gt;&lt;/p&gt;
  664. &lt;/div&gt;
  665. &lt;hr/&gt;
  666. &lt;h3 id=&#34;_lambdacallstatemachine&#34; class=&#34;discrete&#34;&gt;LambdaCallStateMachine&lt;/h3&gt;
  667. &lt;div class=&#34;paragraph&#34;&gt;
  668. &lt;p&gt;Next let’s look at the &lt;strong&gt;LambdaCallStateMachine&lt;/strong&gt; Python Function. The Function can as well be found in the CloudFormation template &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/stepFunctionCertCreation/certificate_xaccount_customresource.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;certificate_xaccount_customresource.yaml&lt;/a&gt;.
  669. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-python&#34; data-lang=&#34;python&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;246&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;          &lt;span class=&#34;kn&#34;&gt;from&lt;/span&gt; &lt;span class=&#34;nn&#34;&gt;botocore.exceptions&lt;/span&gt; &lt;span class=&#34;kn&#34;&gt;import&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;ClientError&lt;/span&gt;
  670. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;247&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;          &lt;span class=&#34;kn&#34;&gt;import&lt;/span&gt; &lt;span class=&#34;nn&#34;&gt;boto3&lt;/span&gt;
  671. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;248&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;          &lt;span class=&#34;kn&#34;&gt;import&lt;/span&gt; &lt;span class=&#34;nn&#34;&gt;cfnresponse&lt;/span&gt;
  672. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;249&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;          &lt;span class=&#34;kn&#34;&gt;import&lt;/span&gt; &lt;span class=&#34;nn&#34;&gt;os&lt;/span&gt;
  673. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;250&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;          &lt;span class=&#34;kn&#34;&gt;import&lt;/span&gt; &lt;span class=&#34;nn&#34;&gt;json&lt;/span&gt;
  674. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;251&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;
  675. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;252&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;          &lt;span class=&#34;n&#34;&gt;statemachineARN&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;os&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;getenv&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;statemachineARN&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  676. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;253&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;
  677. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;254&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;          &lt;span class=&#34;k&#34;&gt;def&lt;/span&gt; &lt;span class=&#34;nf&#34;&gt;lambda_handler&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;event&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;context&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;):&lt;/span&gt;
  678. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;255&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;              &lt;span class=&#34;n&#34;&gt;sfn_client&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;boto3&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;client&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;stepfunctions&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  679. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;256&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;              &lt;span class=&#34;k&#34;&gt;try&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;
  680. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;257&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;n&#34;&gt;response&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;sfn_client&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;start_execution&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;stateMachineArn&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;statemachineARN&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;&lt;span class=&#34;nb&#34;&gt;input&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;json&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;dumps&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;event&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)))&lt;/span&gt;
  681. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;258&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;n&#34;&gt;sfn_arn&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;response&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;get&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;executionArn&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  682. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;259&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;nb&#34;&gt;print&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;sfn_arn&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  683. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;260&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;              &lt;span class=&#34;k&#34;&gt;except&lt;/span&gt; &lt;span class=&#34;ne&#34;&gt;Exception&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;
  684. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;261&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;nb&#34;&gt;print&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;Could not run the Step Functions&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  685. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;262&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;n&#34;&gt;responseData&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;p&#34;&gt;{}&lt;/span&gt;
  686. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;263&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;n&#34;&gt;responseData&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;[&lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;Error&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;]&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;CouldNotCallStateMachine&amp;#34;&lt;/span&gt;
  687. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;264&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;n&#34;&gt;response&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;cfnresponse&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;send&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;event&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;context&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;FAILED&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;responseData&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  688. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;265&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;                  &lt;span class=&#34;k&#34;&gt;return&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;response&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
  689. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;266&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;              &lt;span class=&#34;k&#34;&gt;return&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;sfn_arn&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/p&gt;
  690. &lt;/div&gt;
  691. &lt;div class=&#34;paragraph&#34;&gt;
  692. &lt;p&gt;As you can see on line 252 we will get the ARN of the &lt;strong&gt;CertificateStateMachine&lt;/strong&gt; Step Functions (aka statemachineARN) as environment variable.&lt;br/&gt;
  693. This ARN will be automatically filled with the correct ARN of the &lt;strong&gt;CertificateStateMachine&lt;/strong&gt; Step Functions during CloudFormation deployment (Line 242 → statemachineARN : !Ref CertificateStateMachine).&lt;br/&gt;&lt;/p&gt;
  694. &lt;/div&gt;
  695. &lt;div class=&#34;paragraph&#34;&gt;
  696. &lt;p&gt;In line 257 we call the Step Functions and provide the Lambda Function input event unchanged as json string to the Step Functions. This event input will be provided by AWS CloudFormation during Custom Resource Creation/Update/Deletion.&lt;br/&gt;&lt;/p&gt;
  697. &lt;/div&gt;
  698. &lt;div class=&#34;paragraph&#34;&gt;
  699. &lt;p&gt;This is an example what you can expect in such an input event:&lt;/p&gt;
  700. &lt;/div&gt;
  701. &lt;div class=&#34;paragraph&#34;&gt;
  702. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-json&#34; data-lang=&#34;json&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;p&#34;&gt;{&lt;/span&gt;
  703. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;  &lt;span class=&#34;nt&#34;&gt;&amp;#34;StackId&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;arn:aws:cloudformation:eu-central-1:700000000000:stack/cloudeecms/6g300000-cc00-00ea-aaba-0a0f000aced0&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;
  704. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;  &lt;span class=&#34;nt&#34;&gt;&amp;#34;ResponseURL&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;https://cloudformation-custom-resource-response-eucentral1.s3.eu-central-1.amazonaws.com/arn%3Aaws%3Acloudformation%3Aeu-central-1%3A711632663682%3Astack/cloudeecms/6f371890-cc16-11ea-bbab-0a3f741aced4%7CCustomResourceCertificate%7C4dfd25c6-43c4-4a38-97f5-c14845f454ee?X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;amp;X-Amz-Date=20200722T122539Z&amp;amp;X-Amz-SignedHeaders=host&amp;amp;X-Amz-Expires=7200&amp;amp;X-Amz-Credential=BLGBZZHSTLS2MMALHGQI%3G30400000%2Feu-central-1%2Fs3%2Faws4_request&amp;amp;X-Amz-Signature=3c2424f204c3e935024046g3fd28ld42hs04hd2b1ad2jegw25ls1f924hsf2lsr&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;
  705. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;  &lt;span class=&#34;nt&#34;&gt;&amp;#34;ResourceProperties&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt; &lt;span class=&#34;p&#34;&gt;{&lt;/span&gt;
  706. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;nt&#34;&gt;&amp;#34;HostedZoneId&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;Z00000000AZD0FWVZH0RA&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;
  707. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;nt&#34;&gt;&amp;#34;WebSiteURL&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;www.cloudee-cms.biz&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;
  708. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;nt&#34;&gt;&amp;#34;Region&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;us-east-1&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;
  709. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;nt&#34;&gt;&amp;#34;ServiceToken&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;arn:aws:lambda:eu-central-1:700000000000:function:CallStateMachine-700000000000&amp;#34;&lt;/span&gt;
  710. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;  &lt;span class=&#34;p&#34;&gt;},&lt;/span&gt;
  711. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;  &lt;span class=&#34;nt&#34;&gt;&amp;#34;RequestType&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;Create&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;
  712. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;  &lt;span class=&#34;nt&#34;&gt;&amp;#34;ServiceToken&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;arn:aws:lambda:eu-central-1:700000000000:function:CallStateMachine-700000000000&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;
  713. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;  &lt;span class=&#34;nt&#34;&gt;&amp;#34;ResourceType&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;Custom::CreateCertificate&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;
  714. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;  &lt;span class=&#34;nt&#34;&gt;&amp;#34;RequestId&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;5ehq93f9-28d2-9d20-53g5-d63926g294dw&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;
  715. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;  &lt;span class=&#34;nt&#34;&gt;&amp;#34;LogicalResourceId&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;CustomResourceCertificate&amp;#34;&lt;/span&gt;
  716. &lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;p&#34;&gt;}&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  717. &lt;/div&gt;
  718. &lt;div class=&#34;paragraph&#34;&gt;
  719. &lt;p&gt;If everything works as expected the Lambda will be terminated and the Step Functions will take care of returning a response to the &lt;a href=&#34;https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-lambda-function-code-cfnresponsemodule.html&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;cfn-response&lt;/a&gt; module.
  720. If the Step Functions can’t be triggered we will return an error (line 264) through the &lt;a href=&#34;https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-lambda-function-code-cfnresponsemodule.html&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;cfn-response&lt;/a&gt; module.&lt;br/&gt;
  721. &lt;br/&gt;&lt;/p&gt;
  722. &lt;/div&gt;
  723. &lt;hr/&gt;
  724. &lt;h3 id=&#34;_customresourcecertificate&#34; class=&#34;discrete&#34;&gt;CustomResourceCertificate&lt;/h3&gt;
  725. &lt;div class=&#34;paragraph&#34;&gt;
  726. &lt;p&gt;A custom resource in CloudFormation is defined by a &lt;code&gt;Type&lt;/code&gt; starting with &lt;code&gt;&amp;#39;Custom::&amp;#39;&lt;/code&gt; and the custom resource name, here &lt;code&gt;&amp;#39;CreateCertificate&amp;#39;&lt;/code&gt;.&lt;br/&gt;
  727. The resource must have a &lt;code&gt;ServiceToken&lt;/code&gt;. This token represents the ARN of the Lambda Function or SNS Topic which should be called. In this case we import the ARN of the Lambda Function &lt;code&gt;LambdaCallStateMachine&lt;/code&gt; (which was already created by the certificate_xaccount_customresource.yaml CloudFormation template).&lt;br/&gt;
  728. This custom resource needs 3 additional properties, the &lt;code&gt;WebSiteURL&lt;/code&gt; for which the certificate should be created, the &lt;code&gt;HostedZoneId&lt;/code&gt; of the Route 53 domain in which the needed DNS entry for validation will be created and the &lt;code&gt;Region&lt;/code&gt; where the certificate should be created.&lt;br/&gt;
  729. We already saw these 3 properties inside the Step Functions where &lt;strong&gt;LambdaCreateCertificateRequest&lt;/strong&gt; is called.
  730. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;37&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;CustomResourceCertificate&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  731. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;38&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;Custom::CreateCertificate&amp;#39;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  732. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;39&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Properties&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  733. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;40&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ServiceToken&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;ImportValue LambdaCallStateMachineCertArn&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  734. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;41&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;WebSiteURL&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Ref WebSiteURL&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  735. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;42&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;HostedZoneId&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Ref HostedZoneId&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  736. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;43&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Region&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Ref Region&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/p&gt;
  737. &lt;/div&gt;
  738. &lt;div class=&#34;paragraph&#34;&gt;
  739. &lt;p&gt;You can find the full version of the CloudFormation template which creates the certificate &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/stepFunctionCertCreation/deploycert.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;here&lt;/a&gt;.&lt;/p&gt;
  740. &lt;/div&gt;
  741. &lt;hr/&gt;
  742. &lt;h2 id=&#34;_outlook&#34; class=&#34;discrete&#34;&gt;Outlook&lt;/h2&gt;
  743. &lt;div class=&#34;paragraph&#34;&gt;
  744. &lt;p&gt;I tried to write the Lambda Functions generic so that they can be reused in other Step Functions. This gives us the freedom to use them in a second Step Functions example called &lt;strong&gt;DNSStateMachine&lt;/strong&gt;.
  745. These Step Functions will be used for a Custom CloudFormation Resource which creates DNS entries in our Route 53 Domain AWS Account.&lt;/p&gt;
  746. &lt;/div&gt;
  747. &lt;div class=&#34;imageblock&#34;&gt;
  748. &lt;div class=&#34;content&#34;&gt;
  749. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/202006/stepfunctions_graph2.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/202006/stepfunctions_graph2.png&#34; alt=&#34;DNSStateMachine&#34; width=&#34;800&#34; height=&#34;517&#34;/&gt;&lt;/a&gt;
  750. &lt;/div&gt;
  751. &lt;/div&gt;
  752. &lt;div class=&#34;paragraph&#34;&gt;
  753. &lt;p&gt;&lt;br/&gt;&lt;/p&gt;
  754. &lt;/div&gt;
  755. &lt;div class=&#34;paragraph&#34;&gt;
  756. &lt;p&gt;As you can see we reuse the same Lambda Functions &lt;strong&gt;LambdaCreateDNSEntry&lt;/strong&gt;, &lt;strong&gt;LambdaDeleteResource&lt;/strong&gt; and &lt;strong&gt;LambdaSendResult&lt;/strong&gt;. You find the &lt;strong&gt;DNSStateMachine&lt;/strong&gt; example in the CloudFormation template &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/stepFunctionCertCreation/certificate_xaccount_customresource.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;certificate_xaccount_customresource.yaml&lt;/a&gt; as well.&lt;/p&gt;
  757. &lt;/div&gt;
  758. &lt;hr/&gt;
  759. &lt;h2 id=&#34;_summary&#34; class=&#34;discrete&#34;&gt;Summary&lt;/h2&gt;
  760. &lt;div class=&#34;paragraph&#34;&gt;
  761. &lt;p&gt;This example showed how you can combine a Custom CloudFormation Resource with Step Functions and automatically create an ACM certificate even if the Route 53 Domain for validation is in another AWS account. This gives you an idea how you can start using Step Functions for your own CloudFormation resources.
  762. &lt;br/&gt;
  763. &lt;br/&gt;
  764. &lt;br/&gt;&lt;/p&gt;
  765. &lt;/div&gt;
  766. </description>
  767.    </item>
  768.    
  769.    <item>
  770.      <title>AWS CodePipeline Example which deploys to multiple AWS Accounts - Part2</title>
  771.      <link>https://kbild.ch/blog/2020-5-8-cf_multiple_accounts_regions_part2/</link>
  772.      <pubDate>Tue, 12 May 2020 13:30:10 +0000</pubDate>
  773.      
  774.      <guid>https://kbild.ch/blog/2020-5-8-cf_multiple_accounts_regions_part2/</guid>
  775. <description>&lt;div class=&#34;paragraph&#34;&gt;
  776. &lt;p&gt;In &lt;a href=&#34;https://kbild.ch/blog/2020-5-4-CF_multiple_accounts_regions/&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;Part 1&lt;/a&gt; you find CloudFormation templates which help you to create an AWS CodePipeline that deploys to multiple AWS Accounts. In this Part 2 we will go into some more details how these CF templates work.&lt;/p&gt;
  777. &lt;/div&gt;
  778. &lt;hr/&gt;
  779. &lt;h3 id=&#34;_cloudformation01central_prereqs_yaml&#34; class=&#34;discrete&#34;&gt;cloudformation/01central-prereqs.yaml&lt;/h3&gt;
  780. &lt;div class=&#34;paragraph&#34;&gt;
  781. &lt;p&gt;Let’s first look at the &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/multipleAccountPipeline/cloudformation/01central-prereqs.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;01central-prereqs.yaml&lt;/a&gt; template which creates:&lt;/p&gt;
  782. &lt;/div&gt;
  783. &lt;div class=&#34;imageblock&#34;&gt;
  784. &lt;div class=&#34;content&#34;&gt;
  785. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/202005/arch1.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/202005/arch1.png&#34; alt=&#34;01central-prereqs.yaml&#34; width=&#34;800&#34; height=&#34;199&#34;/&gt;&lt;/a&gt;
  786. &lt;/div&gt;
  787. &lt;/div&gt;
  788. &lt;div class=&#34;ulist&#34;&gt;
  789. &lt;ul&gt;
  790. &lt;li&gt;
  791. &lt;p&gt;S3 Artifact Bucket&lt;br/&gt;&lt;/p&gt;
  792. &lt;/li&gt;
  793. &lt;li&gt;
  794. &lt;p&gt;KMS Key for encryption&lt;br/&gt;&lt;/p&gt;
  795. &lt;/li&gt;
  796. &lt;li&gt;
  797. &lt;p&gt;IAM Roles/Policies&lt;br/&gt;&lt;/p&gt;
  798. &lt;/li&gt;
  799. &lt;li&gt;
  800. &lt;p&gt;CodeCommit Repo for the App&lt;br/&gt;&lt;/p&gt;
  801. &lt;/li&gt;
  802. &lt;li&gt;
  803. &lt;p&gt;CodeBuild Project for App&lt;/p&gt;
  804. &lt;/li&gt;
  805. &lt;/ul&gt;
  806. &lt;/div&gt;
  807. &lt;div class=&#34;paragraph&#34;&gt;
  808. &lt;p&gt;Looking at the template reveals that the &lt;strong&gt;Dev/Test/Prod accounts&lt;/strong&gt; get access to the &lt;strong&gt;KMS Key&lt;/strong&gt;.&lt;br/&gt;
  809. In the &lt;strong&gt;Central Account&lt;/strong&gt; CodeBuild/CodePipeline roles will create the output artifacts, which will be &lt;strong&gt;encrypted&lt;/strong&gt; with the help of the &lt;strong&gt;KMS Key&lt;/strong&gt;.&lt;br/&gt;
  810. Later on these artifacts will be used to deploy the application in your &lt;strong&gt;Dev/Test/Prod accounts&lt;/strong&gt;, therefore the root in these accounts needs access to the &lt;strong&gt;KMS Key&lt;/strong&gt; to &lt;strong&gt;decrypt&lt;/strong&gt; the artifacts.&lt;/p&gt;
  811. &lt;/div&gt;
  812. &lt;div class=&#34;imageblock&#34;&gt;
  813. &lt;div class=&#34;content&#34;&gt;
  814. &lt;img src=&#34;https://kbild.ch/202005/code01.png&#34; alt=&#34;AWS CodePipeline Example&#34;/&gt;
  815. &lt;/div&gt;
  816. &lt;/div&gt;
  817. &lt;div class=&#34;paragraph&#34;&gt;
  818. &lt;p&gt;&lt;br/&gt;
  819. Same is needed for the artifact S3 bucket, but here the roles that will be created by the other template &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/multipleAccountPipeline/cloudformation/02prereqs-accounts.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;02prereqs-accounts.yaml&lt;/a&gt; will need access to the bucket.&lt;/p&gt;
  820. &lt;/div&gt;
  821. &lt;div class=&#34;paragraph&#34;&gt;
  822. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;108&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;S3BucketPolicy&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  823. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;109&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Condition&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;AddPolicies&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  824. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;110&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;AWS::S3::BucketPolicy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  825. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;111&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Properties&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  826. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;112&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Bucket&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Ref ArtifactBucket&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  827. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;113&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;PolicyDocument&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  828. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;114&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Statement&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  829. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;115&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;-&lt;span class=&#34;w&#34;&gt;
  830. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;116&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Action&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  831. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;117&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;s3:GetObject&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  832. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;118&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;s3:PutObject&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  833. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;119&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Effect&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Allow&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  834. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;120&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Resource&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  835. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;121&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub arn:aws:s3:::${ArtifactBucket}&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  836. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;122&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub arn:aws:s3:::${ArtifactBucket}/*&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  837. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;123&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Principal&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  838. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;124&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;AWS&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  839. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;125&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub arn:aws:iam::${TestAccount}:role/${Project}-CentralAcctCodePipelineCFRole&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  840. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;126&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub arn:aws:iam::${TestAccount}:role/${Project}-cloudformationdeployer-role&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  841. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;127&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub arn:aws:iam::${ProductionAccount}:role/${Project}-CentralAcctCodePipelineCFRole&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  842. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;128&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub arn:aws:iam::${ProductionAccount}:role/${Project}-cloudformationdeployer-role&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  843. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;129&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub arn:aws:iam::${DevAccount}:role/${Project}-CentralAcctCodePipelineCFRole&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  844. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;130&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub arn:aws:iam::${DevAccount}:role/${Project}-cloudformationdeployer-role&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  845. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;131&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub arn:aws:iam::${AWS::AccountId}:role/${Project}-codepipeline-Role&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  846. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;132&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub arn:aws:iam::${AWS::AccountId}:role/${Project}-codebuild-Role&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  847. &lt;/div&gt;
  848. &lt;div class=&#34;paragraph&#34;&gt;
  849. &lt;p&gt;&lt;br/&gt;
  850. As you can see this policy is only added if the Condition &amp;#34;AddPolicies&amp;#34; is true, so for the first run of &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/multipleAccountPipeline/cloudformation/01central-prereqs.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;01central-prereqs.yaml&lt;/a&gt; this S3 bucket policy will NOT be created.&lt;br/&gt;
  851. Reason for this is that &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/multipleAccountPipeline/cloudformation/02prereqs-accounts.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;02prereqs-accounts.yaml&lt;/a&gt; has to be deployed on the &lt;strong&gt;Dev/Test/Prod accounts&lt;/strong&gt; first to create all these needed roles.&lt;br/&gt;
  852. Right afterwards &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/multipleAccountPipeline/cloudformation/01central-prereqs.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;01central-prereqs.yaml&lt;/a&gt; has to be run a second time with &amp;#34;AddPolicies&amp;#34; parameter set to true.&lt;/p&gt;
  853. &lt;/div&gt;
  854. &lt;div class=&#34;paragraph&#34;&gt;
  855. &lt;p&gt;&lt;br/&gt;&lt;/p&gt;
  856. &lt;/div&gt;
  857. &lt;div class=&#34;quoteblock&#34;&gt;
  858. &lt;blockquote&gt;
  859. &lt;div class=&#34;paragraph&#34;&gt;
  860. &lt;p&gt;The template would fail to run if these roles are not present in the other accounts.&lt;/p&gt;
  861. &lt;/div&gt;
  862. &lt;/blockquote&gt;
  863. &lt;/div&gt;
  864. &lt;div class=&#34;paragraph&#34;&gt;
  865. &lt;p&gt;&lt;br/&gt;&lt;/p&gt;
  866. &lt;/div&gt;
  867. &lt;div class=&#34;paragraph&#34;&gt;
  868. &lt;p&gt;There are two roles per Account which will get access to the bucket, the &lt;strong&gt;CentralAcctCodePipelineCFRole&lt;/strong&gt; and the &lt;strong&gt;cloudformationdeployer-role&lt;/strong&gt;. Let’s switch to the next template &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/multipleAccountPipeline/cloudformation/02prereqs-accounts.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;02prereqs-accounts.yaml&lt;/a&gt; and look at these roles.&lt;/p&gt;
  869. &lt;/div&gt;
  870. &lt;hr/&gt;
  871. &lt;h3 id=&#34;_cloudformation02prereqs_accounts_yaml&#34; class=&#34;discrete&#34;&gt;cloudformation/02prereqs-accounts.yaml&lt;/h3&gt;
  872. &lt;div class=&#34;paragraph&#34;&gt;
  873. &lt;p&gt;Here you find the &lt;strong&gt;CentralAcctCodePipelineCFRole&lt;/strong&gt; and as you can see, this will be the role which will be assumed by the &lt;strong&gt;Central Account&lt;/strong&gt; CodePipeline to execute the CloudFormation commands.&lt;/p&gt;
  874. &lt;/div&gt;
  875. &lt;div class=&#34;paragraph&#34;&gt;
  876. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;17&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nt&#34;&gt;Resources&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  877. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;18&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;CFRole&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  878. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;19&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;AWS::IAM::Role&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  879. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;20&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Properties&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  880. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;21&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RoleName&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub ${Project}-CentralAcctCodePipelineCFRole&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  881. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;22&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;AssumeRolePolicyDocument&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  882. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;23&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Version&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;ld&#34;&gt;2012-10-17&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  883. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;24&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Statement&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  884. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;25&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;-&lt;span class=&#34;w&#34;&gt;
  885. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;26&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Effect&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Allow&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  886. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;27&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Principal&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  887. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;28&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;AWS&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  888. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;29&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Ref CentralAccount&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  889. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;30&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Action&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  890. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;31&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;sts:AssumeRole&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  891. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;32&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Path&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;/&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  892. &lt;/div&gt;
  893. &lt;div class=&#34;paragraph&#34;&gt;
  894. &lt;p&gt;Looking at the policy used for this role we can see that CloudFormation, S3, IAM and KMS actions are added.&lt;/p&gt;
  895. &lt;/div&gt;
  896. &lt;div class=&#34;paragraph&#34;&gt;
  897. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;33&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;CFPolicy&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  898. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;34&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;AWS::IAM::Policy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  899. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;35&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Properties&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  900. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;36&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;PolicyName&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub ${Project}-CentralAcctCodePipelineCloudFormationPolicy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  901. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;37&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;PolicyDocument&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  902. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;38&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Version&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;ld&#34;&gt;2012-10-17&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  903. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;39&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Statement&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  904. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;40&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;-&lt;span class=&#34;w&#34;&gt;
  905. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;41&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Effect&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Allow&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  906. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;42&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Action&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  907. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;43&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:CreateStack&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  908. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;44&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:DeleteStack&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  909. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;45&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:UpdateStack&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  910. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;46&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:DescribeStacks&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  911. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;47&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:CreateChangeSet&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  912. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;48&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:ExecuteChangeSet&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  913. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;49&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:ListChangeSets&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  914. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;50&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:DescribeChangeSet&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  915. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;51&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:DeleteChangeSet&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  916. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;52&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Resource&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub &amp;#34;arn:aws:cloudformation:${AWS::Region}:*&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  917. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;53&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;-&lt;span class=&#34;w&#34;&gt;
  918. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;54&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Effect&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Allow&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  919. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;55&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Action&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  920. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;56&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;s3:PutObject&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  921. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;57&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;s3:GetObject&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  922. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;58&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Resource&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  923. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;59&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub arn:aws:s3:::${S3Bucket}/*&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  924. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;60&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub arn:aws:s3:::${S3Bucket}&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  925. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;61&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;-&lt;span class=&#34;w&#34;&gt;
  926. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;62&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Effect&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Allow&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  927. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;63&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Action&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  928. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;64&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;iam:PassRole&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  929. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;65&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Resource&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub &amp;#34;arn:aws:iam::${AWS::AccountId}:*&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  930. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;66&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;-&lt;span class=&#34;w&#34;&gt;
  931. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;67&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Effect&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Allow&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  932. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;68&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Action&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  933. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;69&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;kms:Decrypt&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  934. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;70&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;kms:Encrypt&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  935. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;71&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Resource&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  936. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;72&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Ref CMKARN&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  937. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;73&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Roles&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  938. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;74&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;-&lt;span class=&#34;w&#34;&gt;
  939. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;75&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Ref CFRole&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  940. &lt;/div&gt;
  941. &lt;div class=&#34;paragraph&#34;&gt;
  942. &lt;p&gt;The CF actions are used to deploy the CF templates into this account, S3 actions are needed to get the artifacts from the &lt;strong&gt;Central Account&lt;/strong&gt; and KMS actions are needed to decrypt the artifact.&lt;/p&gt;
  943. &lt;/div&gt;
  944. &lt;div class=&#34;paragraph&#34;&gt;
  945. &lt;p&gt;Looking at the &lt;strong&gt;cloudformationdeployer-role&lt;/strong&gt; or better the according policy we see that this role gets similar actions like &lt;strong&gt;CentralAcctCodePipelineCFRole&lt;/strong&gt;. Supplementary some IAM, Lambda and API Gateway actions are added.&lt;/p&gt;
  946. &lt;/div&gt;
  947. &lt;div class=&#34;paragraph&#34;&gt;
  948. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 91&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;CFDeployerPolicy&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  949. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 92&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;AWS::IAM::Policy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  950. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 93&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Properties&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  951. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 94&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;PolicyName&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub ${Project}-cloudformationdeployer-policy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  952. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 95&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;PolicyDocument&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  953. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 96&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Version&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;ld&#34;&gt;2012-10-17&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  954. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 97&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Statement&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  955. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 98&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Sid&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;cf&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  956. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 99&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Effect&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Allow&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  957. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;100&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Action&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  958. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;101&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:CreateStack&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  959. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;102&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:DeleteStack&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  960. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;103&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:UpdateStack&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  961. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;104&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:DescribeStacks&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  962. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;105&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:CreateChangeSet&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  963. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;106&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:ExecuteChangeSet&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  964. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;107&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:ListChangeSets&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  965. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;108&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:DescribeChangeSet&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  966. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;109&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cloudformation:DeleteChangeSet&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  967. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;110&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Resource&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub &amp;#34;arn:aws:cloudformation:${AWS::Region}:*&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  968. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;111&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Sid&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;s3&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  969. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;112&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Effect&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Allow&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  970. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;113&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Action&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  971. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;114&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;s3:PutObject&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  972. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;115&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;s3:GetBucketPolicy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  973. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;116&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;s3:GetObject&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  974. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;117&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;s3:ListBucket&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  975. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;118&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Resource&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  976. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;119&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub &amp;#34;arn:aws:s3:::${S3Bucket}/*&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  977. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;120&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub &amp;#34;arn:aws:s3:::${S3Bucket}&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  978. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;121&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Sid&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;iam&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  979. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;122&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Effect&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Allow&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  980. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;123&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Action&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  981. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;124&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;iam:CreateRole&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  982. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;125&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;iam:DeleteRole&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  983. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;126&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;iam:AttachRolePolicy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  984. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;127&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;iam:DetachRolePolicy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  985. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;128&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;iam:getRolePolicy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  986. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;129&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;iam:PutRolePolicy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  987. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;130&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;iam:DeleteRolePolicy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  988. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;131&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;iam:GetRole&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  989. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;132&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;iam:PassRole&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  990. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;133&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;iam:CreateServiceLinkedRole&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  991. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;134&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Resource&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  992. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;135&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub &amp;#34;arn:aws:iam::${AWS::AccountId}:role/*&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  993. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;136&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Sid&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;ssm&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  994. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;137&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Effect&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Allow&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  995. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;138&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Action&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  996. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;139&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;ssm:GetParameters&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  997. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;140&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Resource&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  998. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;141&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub &amp;#34;arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  999. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;142&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Sid&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;lambda&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1000. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;143&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Effect&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Allow&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1001. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;144&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Action&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1002. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;145&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;lambda:CreateFunction&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1003. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;146&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;lambda:DeleteFunction&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1004. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;147&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;lambda:GetFunctionConfiguration&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1005. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;148&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;lambda:AddPermission&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1006. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;149&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;lambda:RemovePermission&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1007. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;150&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;lambda:UpdateFunctionConfiguration&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1008. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;151&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;lambda:UpdateFunctionCode&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1009. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;152&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Resource&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1010. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;153&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub &amp;#34;arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:*&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1011. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;154&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Sid&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;apigw&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1012. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;155&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Effect&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Allow&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1013. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;156&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Action&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1014. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;157&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;apigateway:POST&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1015. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;158&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;apigateway:DELETE&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1016. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;159&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;apigateway:PATCH&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1017. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;160&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;apigateway:GET&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1018. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;161&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Resource&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1019. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;162&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;- !&lt;span class=&#34;l&#34;&gt;Sub &amp;#34;arn:aws:apigateway:${AWS::Region}::/*&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1020. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;163&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Roles&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1021. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;164&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;-&lt;span class=&#34;w&#34;&gt;
  1022. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;165&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Ref CFDeployerRole&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  1023. &lt;/div&gt;
  1024. &lt;div class=&#34;paragraph&#34;&gt;
  1025. &lt;p&gt;All these actions are needed to create our application:&lt;/p&gt;
  1026. &lt;/div&gt;
  1027. &lt;div class=&#34;ulist&#34;&gt;
  1028. &lt;ul&gt;
  1029. &lt;li&gt;
  1030. &lt;p&gt;IAM actions to create all needed roles/policies&lt;/p&gt;
  1031. &lt;/li&gt;
  1032. &lt;li&gt;
  1033. &lt;p&gt;Lambda actions to create our serverless functions&lt;/p&gt;
  1034. &lt;/li&gt;
  1035. &lt;li&gt;
  1036. &lt;p&gt;API Gateway actions to create endpoints of the application&lt;/p&gt;
  1037. &lt;/li&gt;
  1038. &lt;/ul&gt;
  1039. &lt;/div&gt;
  1040. &lt;div class=&#34;paragraph&#34;&gt;
  1041. &lt;p&gt;If you will use this example to deploy your own applications to multiple AWS accounts this role/policy has to be customized to fit your needs.&lt;/p&gt;
  1042. &lt;/div&gt;
  1043. &lt;div class=&#34;quoteblock&#34;&gt;
  1044. &lt;blockquote&gt;
  1045. &lt;div class=&#34;paragraph&#34;&gt;
  1046. &lt;p&gt;All actions which will be needed to deploy your application have to be added here.&lt;/p&gt;
  1047. &lt;/div&gt;
  1048. &lt;/blockquote&gt;
  1049. &lt;/div&gt;
  1050. &lt;div class=&#34;paragraph&#34;&gt;
  1051. &lt;p&gt;Let’s look at the last template,&lt;/p&gt;
  1052. &lt;/div&gt;
  1053. &lt;hr/&gt;
  1054. &lt;h3 id=&#34;_cloudformation03central_pipeline_yaml&#34; class=&#34;discrete&#34;&gt;cloudformation/03central-pipeline.yaml&lt;/h3&gt;
  1055. &lt;div class=&#34;paragraph&#34;&gt;
  1056. &lt;p&gt;This template which will be used in the &lt;strong&gt;Central account&lt;/strong&gt; creates only one resource, the CodePipeline.
  1057. As you can see this CodePipeline will use the KMS Key as encryption key and will use the S3 bucket as artifact store.&lt;/p&gt;
  1058. &lt;/div&gt;
  1059. &lt;div class=&#34;imageblock&#34;&gt;
  1060. &lt;div class=&#34;content&#34;&gt;
  1061. &lt;img src=&#34;https://kbild.ch/202005/code1.png&#34; alt=&#34;AWS CodePipeline Example&#34;/&gt;
  1062. &lt;/div&gt;
  1063. &lt;/div&gt;
  1064. &lt;div class=&#34;paragraph&#34;&gt;
  1065. &lt;p&gt;We see 5 stages:&lt;/p&gt;
  1066. &lt;/div&gt;
  1067. &lt;div class=&#34;ulist&#34;&gt;
  1068. &lt;ul&gt;
  1069. &lt;li&gt;
  1070. &lt;p&gt;Getting the source from CodeCommit&lt;/p&gt;
  1071. &lt;/li&gt;
  1072. &lt;li&gt;
  1073. &lt;p&gt;Build the templates with CodeBuild&lt;/p&gt;
  1074. &lt;/li&gt;
  1075. &lt;li&gt;
  1076. &lt;p&gt;Create/deploy change sets to &lt;strong&gt;Dev account&lt;/strong&gt;&lt;/p&gt;
  1077. &lt;/li&gt;
  1078. &lt;li&gt;
  1079. &lt;p&gt;Create/deploy change sets to &lt;strong&gt;Test account&lt;/strong&gt;&lt;/p&gt;
  1080. &lt;/li&gt;
  1081. &lt;li&gt;
  1082. &lt;p&gt;Create/deploy change sets to &lt;strong&gt;Prod account&lt;/strong&gt;&lt;/p&gt;
  1083. &lt;/li&gt;
  1084. &lt;/ul&gt;
  1085. &lt;/div&gt;
  1086. &lt;div class=&#34;paragraph&#34;&gt;
  1087. &lt;p&gt;CodeCommit and CodeBuild stages are easy to understand, no magic there, but let’s look at the create/deploy change sets to the different accounts:&lt;/p&gt;
  1088. &lt;/div&gt;
  1089. &lt;div class=&#34;paragraph&#34;&gt;
  1090. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 57&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Create_Change_Sets_and_Deploy_to_Dev&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1091. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 58&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Actions&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1092. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 59&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;CreateChangeSet_Dev&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1093. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 60&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ActionTypeId&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1094. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 61&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Category&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Deploy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1095. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 62&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Owner&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;AWS&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1096. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 63&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Version&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;1&amp;#39;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1097. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 64&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Provider&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;CloudFormation&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1098. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 65&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Configuration&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1099. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 66&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ChangeSetName&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;cicd-codepipeline-ChangeSet-Dev&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1100. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 67&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ActionMode&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;CHANGE_SET_REPLACE&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1101. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 68&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;StackName&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;cicd-codepipeline-Dev&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1102. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 69&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Capabilities&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;CAPABILITY_IAM&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1103. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 70&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ParameterOverrides&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;|&lt;/span&gt;&lt;span class=&#34;sd&#34;&gt;
  1104. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 71&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                  {
  1105. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 72&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                  &amp;#34;Environment&amp;#34; : &amp;#34;dev&amp;#34;
  1106. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 73&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                  }&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;                  
  1107. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 74&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;TemplatePath&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;BuildArtifact::packaged.yml&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1108. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 75&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RoleArn&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1109. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 76&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Fn::ImportValue&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1110. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 77&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                    &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub &amp;#34;${Project}-Dev-cloudformationdeployer-role&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1111. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 78&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;InputArtifacts&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1112. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 79&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;BuildArtifact&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1113. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 80&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RunOrder&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;m&#34;&gt;1&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1114. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 81&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RoleArn&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1115. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 82&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Fn::ImportValue&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1116. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 83&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                  &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub &amp;#34;${Project}-Dev-centralacctcodepipelineCFRole&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1117. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 84&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;ExecuteChangeSet_Dev&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1118. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 85&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ActionTypeId&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1119. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 86&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Category&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Deploy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1120. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 87&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Owner&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;AWS&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1121. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 88&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Provider&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;CloudFormation&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1122. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 89&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Version&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;1&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1123. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 90&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Configuration&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1124. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 91&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ActionMode&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;CHANGE_SET_EXECUTE&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1125. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 92&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RoleArn&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1126. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 93&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Fn::ImportValue&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1127. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 94&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                    &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub &amp;#34;${Project}-Dev-cloudformationdeployer-role&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1128. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 95&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;StackName&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;cicd-codepipeline-Dev&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1129. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 96&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ChangeSetName&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;cicd-codepipeline-ChangeSet-Dev&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1130. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 97&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;OutputArtifacts&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1131. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 98&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;cicd-codepipeline-ChangeSet-Dev&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1132. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt; 99&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RunOrder&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;m&#34;&gt;2&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1133. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;100&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RoleArn&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1134. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;101&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Fn::ImportValue&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1135. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;102&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                  &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub &amp;#34;${Project}-Dev-centralacctcodepipelineCFRole&amp;#34;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  1136. &lt;/div&gt;
  1137. &lt;hr/&gt;
  1138. &lt;div class=&#34;paragraph&#34;&gt;
  1139. &lt;p&gt;The key point here are the values used for &lt;strong&gt;RoleArn’s&lt;/strong&gt; and that you can define roles for the creation/execution of CloudFormation change sets.&lt;/p&gt;
  1140. &lt;/div&gt;
  1141. &lt;div class=&#34;paragraph&#34;&gt;
  1142. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;81&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RoleArn&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1143. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;82&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Fn::ImportValue&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1144. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;83&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                  &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub &amp;#34;${Project}-Dev-centralacctcodepipelineCFRole&amp;#34;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  1145. &lt;/div&gt;
  1146. &lt;div class=&#34;paragraph&#34;&gt;
  1147. &lt;p&gt;This is the role (&lt;strong&gt;CentralAcctCodePipelineCFRole&lt;/strong&gt;) used by the CodePipeline in the &lt;strong&gt;Central account&lt;/strong&gt; to execute the CloudFormation template in the &lt;strong&gt;Dev account&lt;/strong&gt;.&lt;br/&gt;
  1148. &lt;br/&gt;
  1149. The role was created on the &lt;strong&gt;Dev account&lt;/strong&gt; with the &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/multipleAccountPipeline/cloudformation/02prereqs-accounts.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;02prereqs-accounts.yaml&lt;/a&gt; template but the ARN value can be calculated.&lt;br/&gt;
  1150. &lt;br/&gt;
  1151. This is done in the &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/multipleAccountPipeline/cloudformation/01central-prereqs.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;01central-prereqs.yaml&lt;/a&gt; template and imported here in this template  &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/multipleAccountPipeline/cloudformation/03central-pipeline.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;03central-pipeline.yaml&lt;/a&gt;.&lt;br/&gt;
  1152. &lt;br/&gt;
  1153. Snippet from &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/multipleAccountPipeline/cloudformation/01central-prereqs.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;01central-prereqs.yaml&lt;/a&gt;:&lt;/p&gt;
  1154. &lt;/div&gt;
  1155. &lt;div class=&#34;paragraph&#34;&gt;
  1156. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;326&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;DevCodePipelineCloudFormationRole&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1157. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;327&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Value&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub arn:aws:iam::${DevAccount}:role/${Project}-CentralAcctCodePipelineCFRole&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1158. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;328&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Export&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1159. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;329&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub ${Project}-Dev-centralacctcodepipelineCFRole&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  1160. &lt;/div&gt;
  1161. &lt;hr/&gt;
  1162. &lt;div class=&#34;paragraph&#34;&gt;
  1163. &lt;p&gt;The second role (&lt;strong&gt;cloudformationdeployer-role&lt;/strong&gt;) is used to deploy the resources inside the &lt;strong&gt;Dev account&lt;/strong&gt; which are defined in the CloudFormation template. That’s the same IAM Role setting which you will see if you manually deploy a CloudFormation stack under &amp;#34;Configure stack options&amp;#34; → &amp;#34;Permissions&amp;#34;&lt;/p&gt;
  1164. &lt;/div&gt;
  1165. &lt;div class=&#34;paragraph&#34;&gt;
  1166. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;65&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;              &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Configuration&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1167. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;66&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ChangeSetName&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;cicd-codepipeline-ChangeSet-Dev&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1168. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;67&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ActionMode&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;CHANGE_SET_REPLACE&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1169. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;68&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;StackName&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;cicd-codepipeline-Dev&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1170. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;69&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Capabilities&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;CAPABILITY_IAM&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1171. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;70&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ParameterOverrides&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;|&lt;/span&gt;&lt;span class=&#34;sd&#34;&gt;
  1172. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;71&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                  {
  1173. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;72&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                  &amp;#34;Environment&amp;#34; : &amp;#34;dev&amp;#34;
  1174. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;73&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;sd&#34;&gt;                  }&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;                  
  1175. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;74&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;TemplatePath&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;BuildArtifact::packaged.yml&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1176. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;75&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RoleArn&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1177. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;76&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Fn::ImportValue&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1178. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;77&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                    &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Sub &amp;#34;${Project}-Dev-cloudformationdeployer-role&amp;#34;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  1179. &lt;/div&gt;
  1180. &lt;div class=&#34;paragraph&#34;&gt;
  1181. &lt;p&gt;As you can see the RoleArn is defined inside the &lt;strong&gt;Configuration&lt;/strong&gt; part of the Create/Execute change set. This is the role/policy we saw before which has to be customized to fit your needs if you will use this example to deploy your own applications to multiple AWS accounts.&lt;/p&gt;
  1182. &lt;/div&gt;
  1183. &lt;hr/&gt;
  1184. &lt;div class=&#34;paragraph&#34;&gt;
  1185. &lt;p&gt;Hope this Part 2 gave you more details on how this example works &amp;amp; how you can customize it.&lt;br/&gt;&lt;/p&gt;
  1186. &lt;/div&gt;
  1187. &lt;div class=&#34;quoteblock&#34;&gt;
  1188. &lt;blockquote&gt;
  1189. &lt;div class=&#34;paragraph&#34;&gt;
  1190. &lt;p&gt;&lt;strong&gt;The magic happens at the RoleArn that are used at the different CodePipeline stages!&lt;/strong&gt;&lt;br/&gt;&lt;/p&gt;
  1191. &lt;/div&gt;
  1192. &lt;/blockquote&gt;
  1193. &lt;/div&gt;
  1194. &lt;div class=&#34;paragraph&#34;&gt;
  1195. &lt;p&gt;The beauty of this is that if you have a working solution like this you can reuse it almost everywhere.&lt;/p&gt;
  1196. &lt;/div&gt;
  1197. &lt;div class=&#34;paragraph&#34;&gt;
  1198. &lt;p&gt;Comments and questions are welcome or contact me on &lt;a href=&#34;https://www.twitter.com/kbild&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;Twitter&lt;/a&gt;.
  1199. &lt;br/&gt;
  1200. &lt;br/&gt;
  1201. &lt;br/&gt;&lt;/p&gt;
  1202. &lt;/div&gt;
  1203. </description>
  1204.    </item>
  1205.    
  1206.    <item>
  1207.      <title>AWS CodePipeline Example which deploys to multiple AWS Accounts - Part1</title>
  1208.      <link>https://kbild.ch/blog/2020-5-4-cf_multiple_accounts_regions/</link>
  1209.      <pubDate>Mon, 04 May 2020 07:30:10 +0000</pubDate>
  1210.      
  1211.      <guid>https://kbild.ch/blog/2020-5-4-cf_multiple_accounts_regions/</guid>
  1212. <description>&lt;div class=&#34;paragraph&#34;&gt;
  1213. &lt;p&gt;At &lt;a href=&#34;https://webgate.biz&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;WebGate&lt;/a&gt;, we’re using AWS CodePipeline heavily for CI/CD of our serverless apps and we usually do 3-tier deployments (Dev, Test, Prod).
  1214. &lt;br/&gt;&lt;/p&gt;
  1215. &lt;/div&gt;
  1216. &lt;div class=&#34;paragraph&#34;&gt;
  1217. &lt;p&gt;Therefore we were looking for an example which describes how you have to build such a solution. Unfortunately we didn’t found a source which had a full blown solution matching our needs. Luckily we found some examples which gave us some clues on how to build such a Pipeline.&lt;/p&gt;
  1218. &lt;/div&gt;
  1219. &lt;div class=&#34;paragraph&#34;&gt;
  1220. &lt;p&gt;Especially following two sites helped us to get started:&lt;br/&gt;&lt;/p&gt;
  1221. &lt;/div&gt;
  1222. &lt;div class=&#34;paragraph&#34;&gt;
  1223. &lt;p&gt;&lt;a href=&#34;https://aws.amazon.com/blogs/devops/aws-building-a-secure-cross-account-continuous-delivery-pipeline/&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;- Building a Secure Cross-Account Continuous Delivery Pipeline &lt;/a&gt;&lt;br/&gt;
  1224. &lt;a href=&#34;https://aws.amazon.com/premiumsupport/knowledge-center/codepipeline-deploy-cloudformation/&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;- How do I use CodePipeline to deploy an AWS CloudFormation stack in a different account? &lt;/a&gt;&lt;br/&gt;&lt;/p&gt;
  1225. &lt;/div&gt;
  1226. &lt;div class=&#34;paragraph&#34;&gt;
  1227. &lt;p&gt;&lt;br/&gt;
  1228. In this post I will show you an example which you can use for your own cross-account AWS CodePipelines.&lt;br/&gt;&lt;/p&gt;
  1229. &lt;/div&gt;
  1230. &lt;div class=&#34;paragraph&#34;&gt;
  1231. &lt;p&gt;We will have:&lt;/p&gt;
  1232. &lt;/div&gt;
  1233. &lt;div class=&#34;ulist&#34;&gt;
  1234. &lt;ul&gt;
  1235. &lt;li&gt;
  1236. &lt;p&gt;&amp;#34;Central Account&amp;#34; → App Repos, Pipelines…​&lt;/p&gt;
  1237. &lt;/li&gt;
  1238. &lt;li&gt;
  1239. &lt;p&gt;&amp;#34;Dev Account&amp;#34; → Development Account for App&lt;/p&gt;
  1240. &lt;/li&gt;
  1241. &lt;li&gt;
  1242. &lt;p&gt;&amp;#34;Test Account&amp;#34; → Testing Account for App&lt;/p&gt;
  1243. &lt;/li&gt;
  1244. &lt;li&gt;
  1245. &lt;p&gt;&amp;#34;Prod Account&amp;#34; → Production Account for App
  1246. &lt;br/&gt;
  1247. &lt;br/&gt;&lt;/p&gt;
  1248. &lt;/li&gt;
  1249. &lt;/ul&gt;
  1250. &lt;/div&gt;
  1251. &lt;hr/&gt;
  1252. &lt;h2 id=&#34;_how_to_deploy&#34; class=&#34;discrete&#34;&gt;How to Deploy&lt;/h2&gt;
  1253. &lt;div class=&#34;paragraph&#34;&gt;
  1254. &lt;p&gt;You will find the source code of this example in &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/tree/master/multipleAccountPipeline/&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;this Github repo&lt;/a&gt;, let’s first deploy the prerequisites and later the sample repo.
  1255. &lt;br/&gt;
  1256. &lt;br/&gt;&lt;/p&gt;
  1257. &lt;/div&gt;
  1258. &lt;hr/&gt;
  1259. &lt;h3 id=&#34;_1_prerequisites&#34; class=&#34;discrete&#34;&gt;1. Prerequisites&lt;/h3&gt;
  1260. &lt;div class=&#34;paragraph&#34;&gt;
  1261. &lt;p&gt;There are 3 AWS CloudFormation templates which you will need to deploy this solution, let’s first have a look at them:
  1262. &lt;br/&gt;
  1263. &lt;br/&gt;&lt;/p&gt;
  1264. &lt;/div&gt;
  1265. &lt;h4 id=&#34;_cloudformation01central_prereqs_yaml&#34; class=&#34;discrete&#34;&gt;cloudformation/01central-prereqs.yaml&lt;/h4&gt;
  1266. &lt;div class=&#34;paragraph&#34;&gt;
  1267. &lt;p&gt;This &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/multipleAccountPipeline/cloudformation/01central-prereqs.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;template&lt;/a&gt; will deploy all needed resources in the &amp;#34;Central Account&amp;#34;:&lt;br/&gt;&lt;/p&gt;
  1268. &lt;/div&gt;
  1269. &lt;div class=&#34;imageblock left&#34;&gt;
  1270. &lt;div class=&#34;content&#34;&gt;
  1271. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/202005/arch1.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/202005/arch1.png&#34; alt=&#34;01central-prereqs.yaml&#34; width=&#34;800&#34; height=&#34;199&#34;/&gt;&lt;/a&gt;
  1272. &lt;/div&gt;
  1273. &lt;/div&gt;
  1274. &lt;hr/&gt;
  1275. &lt;div class=&#34;ulist&#34;&gt;
  1276. &lt;ul&gt;
  1277. &lt;li&gt;
  1278. &lt;p&gt;S3 Artifact Bucket&lt;br/&gt;&lt;/p&gt;
  1279. &lt;/li&gt;
  1280. &lt;li&gt;
  1281. &lt;p&gt;KMS Key for encryption&lt;br/&gt;&lt;/p&gt;
  1282. &lt;/li&gt;
  1283. &lt;li&gt;
  1284. &lt;p&gt;IAM Roles/Policies&lt;br/&gt;&lt;/p&gt;
  1285. &lt;/li&gt;
  1286. &lt;li&gt;
  1287. &lt;p&gt;CodeCommit Repo for the App&lt;br/&gt;&lt;/p&gt;
  1288. &lt;/li&gt;
  1289. &lt;li&gt;
  1290. &lt;p&gt;CodeBuild Project for App
  1291. &lt;br/&gt;
  1292. &lt;br/&gt;&lt;/p&gt;
  1293. &lt;/li&gt;
  1294. &lt;/ul&gt;
  1295. &lt;/div&gt;
  1296. &lt;h4 id=&#34;_cloudformation02prereqs_accounts_yaml&#34; class=&#34;discrete&#34;&gt;cloudformation/02prereqs-accounts.yaml&lt;/h4&gt;
  1297. &lt;div class=&#34;paragraph&#34;&gt;
  1298. &lt;p&gt;This &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/multipleAccountPipeline/cloudformation/02prereqs-accounts.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;template&lt;/a&gt;  will deploy all needed resources in the &amp;#34;Dev Account&amp;#34;, &amp;#34;Test Account&amp;#34; and &amp;#34;Prod Account&amp;#34;:&lt;br/&gt;&lt;/p&gt;
  1299. &lt;/div&gt;
  1300. &lt;table class=&#34;tableblock frame-all grid-all stretch tablenoborder&#34;&gt;
  1301. &lt;colgroup&gt;
  1302. &lt;col style=&#34;width: 50%;&#34;/&gt;
  1303. &lt;col style=&#34;width: 50%;&#34;/&gt;
  1304. &lt;/colgroup&gt;
  1305. &lt;tbody&gt;
  1306. &lt;tr&gt;
  1307. &lt;td class=&#34;tableblock halign-left valign-top&#34;&gt;&lt;div class=&#34;content&#34;&gt;&lt;div class=&#34;imageblock&#34;&gt;
  1308. &lt;div class=&#34;content&#34;&gt;
  1309. &lt;img src=&#34;https://kbild.ch/202005/arch2.png&#34; alt=&#34;01central-prereqs.yaml&#34; width=&#34;400&#34; height=&#34;215&#34;/&gt;
  1310. &lt;/div&gt;
  1311. &lt;/div&gt;&lt;/div&gt;&lt;/td&gt;
  1312. &lt;td class=&#34;tableblock halign-left valign-top&#34;&gt;&lt;div class=&#34;content&#34;&gt;&lt;div class=&#34;ulist&#34;&gt;
  1313. &lt;ul&gt;
  1314. &lt;li&gt;
  1315. &lt;p&gt;IAM Roles/Policies&lt;/p&gt;
  1316. &lt;/li&gt;
  1317. &lt;/ul&gt;
  1318. &lt;/div&gt;&lt;/div&gt;&lt;/td&gt;
  1319. &lt;/tr&gt;
  1320. &lt;/tbody&gt;
  1321. &lt;/table&gt;
  1322. &lt;h4 id=&#34;_cloudformation03central_pipeline_yaml&#34; class=&#34;discrete&#34;&gt;cloudformation/03central-pipeline.yaml&lt;/h4&gt;
  1323. &lt;div class=&#34;paragraph&#34;&gt;
  1324. &lt;p&gt;This &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/multipleAccountPipeline/cloudformation/03central-pipeline.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;template&lt;/a&gt; will deploy the actual Code Pipeline in the &amp;#34;Central Account&amp;#34;.&lt;br/&gt;
  1325. For simplicity I’m only deploying a simple &amp;#34;Hello World&amp;#34; Lambda function and an API Gateway and I’m only using the Build and Deploy Stages in the Pipeline:&lt;/p&gt;
  1326. &lt;/div&gt;
  1327. &lt;div class=&#34;imageblock left&#34;&gt;
  1328. &lt;div class=&#34;content&#34;&gt;
  1329. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/202005/arch3.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/202005/arch3.png&#34; alt=&#34;AWS CodePipeline Example&#34; width=&#34;800&#34; height=&#34;499&#34;/&gt;&lt;/a&gt;
  1330. &lt;/div&gt;
  1331. &lt;/div&gt;
  1332. &lt;hr/&gt;
  1333. &lt;hr/&gt;
  1334. &lt;h3 id=&#34;_2_how_to_deploy_the_prerequisites&#34; class=&#34;discrete&#34;&gt;2. How to Deploy the Prerequisites&lt;/h3&gt;
  1335. &lt;h4 id=&#34;_central_account&#34; class=&#34;discrete&#34;&gt;Central Account&lt;/h4&gt;
  1336. &lt;div class=&#34;paragraph&#34;&gt;
  1337. &lt;p&gt;First logon to your &lt;strong&gt;Central Account&lt;/strong&gt; and open up CloudFormation in the Region of choice.&lt;br/&gt;
  1338. Now create a new stack with the template &lt;strong&gt;01central-prereqs.yaml&lt;/strong&gt; and define:&lt;/p&gt;
  1339. &lt;/div&gt;
  1340. &lt;div class=&#34;imageblock left&#34;&gt;
  1341. &lt;div class=&#34;content&#34;&gt;
  1342. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/202005/cf1.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/202005/cf1.png&#34; alt=&#34;01central-prereqs.yaml&#34; width=&#34;800&#34; height=&#34;561&#34;/&gt;&lt;/a&gt;
  1343. &lt;/div&gt;
  1344. &lt;/div&gt;
  1345. &lt;hr/&gt;
  1346. &lt;div class=&#34;ulist&#34;&gt;
  1347. &lt;ul&gt;
  1348. &lt;li&gt;
  1349. &lt;p&gt;Stack Name i.e. &lt;em&gt;kbild-serverless-prereqs&lt;/em&gt;&lt;/p&gt;
  1350. &lt;/li&gt;
  1351. &lt;li&gt;
  1352. &lt;p&gt;AWS Account Numbers for the Dev, Test and Prod Accounts&lt;/p&gt;
  1353. &lt;/li&gt;
  1354. &lt;li&gt;
  1355. &lt;p&gt;PreReqsOnAccounts, should stay &amp;#34;false&amp;#34;&lt;/p&gt;
  1356. &lt;/li&gt;
  1357. &lt;li&gt;
  1358. &lt;p&gt;Project name i.e. &lt;em&gt;serverless&lt;/em&gt;&lt;/p&gt;
  1359. &lt;/li&gt;
  1360. &lt;/ul&gt;
  1361. &lt;/div&gt;
  1362. &lt;div class=&#34;paragraph&#34;&gt;
  1363. &lt;p&gt;&lt;br/&gt;
  1364. Finish the stack deployment, it will take some minutes. When finished, open up the Outputs tab of the stack and take a note of the &amp;#34;ArtifactBucket&amp;#34; and &amp;#34;CMK&amp;#34; Key values.&lt;/p&gt;
  1365. &lt;/div&gt;
  1366. &lt;div class=&#34;imageblock left&#34;&gt;
  1367. &lt;div class=&#34;content&#34;&gt;
  1368. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/202005/cf5.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/202005/cf5.png&#34; alt=&#34;01central-prereqs.yaml&#34; width=&#34;800&#34; height=&#34;244&#34;/&gt;&lt;/a&gt;
  1369. &lt;/div&gt;
  1370. &lt;/div&gt;
  1371. &lt;hr/&gt;
  1372. &lt;div class=&#34;paragraph&#34;&gt;
  1373. &lt;p&gt;&lt;br/&gt;&lt;/p&gt;
  1374. &lt;/div&gt;
  1375. &lt;h4 id=&#34;_dev_account&#34; class=&#34;discrete&#34;&gt;Dev Account&lt;/h4&gt;
  1376. &lt;div class=&#34;paragraph&#34;&gt;
  1377. &lt;p&gt;Now logon to your &lt;strong&gt;Dev Account&lt;/strong&gt; and open up CloudFormation in the same Region as used for the &amp;#34;Central Account&amp;#34;&lt;br/&gt;
  1378. Here we create a new stack and we will use the template &lt;strong&gt;02prereqs-accounts.yaml&lt;/strong&gt;:&lt;/p&gt;
  1379. &lt;/div&gt;
  1380. &lt;div class=&#34;imageblock left&#34;&gt;
  1381. &lt;div class=&#34;content&#34;&gt;
  1382. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/202005/cf2.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/202005/cf2.png&#34; alt=&#34;01central-prereqs.yaml&#34; width=&#34;800&#34; height=&#34;568&#34;/&gt;&lt;/a&gt;
  1383. &lt;/div&gt;
  1384. &lt;/div&gt;
  1385. &lt;hr/&gt;
  1386. &lt;div class=&#34;ulist&#34;&gt;
  1387. &lt;ul&gt;
  1388. &lt;li&gt;
  1389. &lt;p&gt;Stack Name i.e. &lt;em&gt;kbild-serverless-prereqs&lt;/em&gt;&lt;/p&gt;
  1390. &lt;/li&gt;
  1391. &lt;li&gt;
  1392. &lt;p&gt;CMKARN → Fill in the value of the &amp;#34;CMK&amp;#34; Key noted before&lt;/p&gt;
  1393. &lt;/li&gt;
  1394. &lt;li&gt;
  1395. &lt;p&gt;CentralAccount → Fill in the account number of the &amp;#34;Central Account&amp;#34;&lt;/p&gt;
  1396. &lt;/li&gt;
  1397. &lt;li&gt;
  1398. &lt;p&gt;Project name i.e. &lt;em&gt;serverless&lt;/em&gt;&lt;/p&gt;
  1399. &lt;/li&gt;
  1400. &lt;li&gt;
  1401. &lt;p&gt;S3Bucket → Fill in the value of the &amp;#34;ArtifactBucket&amp;#34; Key&lt;/p&gt;
  1402. &lt;/li&gt;
  1403. &lt;/ul&gt;
  1404. &lt;/div&gt;
  1405. &lt;div class=&#34;paragraph&#34;&gt;
  1406. &lt;p&gt;&lt;br/&gt;
  1407. Wait for the stack deployment to be finished.
  1408. &lt;br/&gt;
  1409. &lt;br/&gt;&lt;/p&gt;
  1410. &lt;/div&gt;
  1411. &lt;h4 id=&#34;_test_account_prod_account&#34; class=&#34;discrete&#34;&gt;Test Account / Prod Account&lt;/h4&gt;
  1412. &lt;div class=&#34;paragraph&#34;&gt;
  1413. &lt;p&gt;Now logon to your &lt;strong&gt;Test Account&lt;/strong&gt; / &lt;strong&gt;Prod Account&lt;/strong&gt; and repeat the steps for &lt;strong&gt;02prereqs-accounts.yaml&lt;/strong&gt;&lt;/p&gt;
  1414. &lt;/div&gt;
  1415. &lt;div class=&#34;paragraph&#34;&gt;
  1416. &lt;p&gt;&lt;br/&gt;&lt;/p&gt;
  1417. &lt;/div&gt;
  1418. &lt;h4 id=&#34;_central_account_2&#34; class=&#34;discrete&#34;&gt;Central Account&lt;/h4&gt;
  1419. &lt;div class=&#34;paragraph&#34;&gt;
  1420. &lt;p&gt;Now you have to go back to your &lt;strong&gt;Central Account&lt;/strong&gt;.&lt;/p&gt;
  1421. &lt;/div&gt;
  1422. &lt;div class=&#34;quoteblock&#34;&gt;
  1423. &lt;blockquote&gt;
  1424. &lt;div class=&#34;paragraph&#34;&gt;
  1425. &lt;p&gt;Please ensure that the prerequisites are already deployed to the &amp;#34;Dev/Test Prod Account&amp;#34;,
  1426. otherwise the following update will fail!&lt;/p&gt;
  1427. &lt;/div&gt;
  1428. &lt;/blockquote&gt;
  1429. &lt;/div&gt;
  1430. &lt;div class=&#34;paragraph&#34;&gt;
  1431. &lt;p&gt;Do an update on the Prereqs Stack which you created some minutes ago. Choose &amp;#34;Use current template&amp;#34; and change the value of parameter &lt;strong&gt;PreReqsOnAccounts&lt;/strong&gt; from &lt;strong&gt;false&lt;/strong&gt; to &lt;strong&gt;true&lt;/strong&gt; and update the stack:&lt;/p&gt;
  1432. &lt;/div&gt;
  1433. &lt;div class=&#34;paragraph&#34;&gt;
  1434. &lt;p&gt;&lt;span class=&#34;image&#34;&gt;&lt;img src=&#34;https://kbild.ch/202005/cf4.png&#34; alt=&#34;01central-prereqs.yaml&#34; width=&#34;208&#34; height=&#34;172&#34;/&gt;&lt;/span&gt;&lt;/p&gt;
  1435. &lt;/div&gt;
  1436. &lt;div class=&#34;paragraph&#34;&gt;
  1437. &lt;p&gt;This will update the S3 Artifact bucket and KMS Policies and will add access for to the &amp;#34;Dev/Test Prod Accounts&amp;#34;.&lt;/p&gt;
  1438. &lt;/div&gt;
  1439. &lt;div class=&#34;paragraph&#34;&gt;
  1440. &lt;p&gt;&lt;br/&gt;&lt;/p&gt;
  1441. &lt;/div&gt;
  1442. &lt;hr/&gt;
  1443. &lt;h3 id=&#34;_3_deploy_pipeline_and_app&#34; class=&#34;discrete&#34;&gt;3. Deploy Pipeline and App&lt;/h3&gt;
  1444. &lt;h4 id=&#34;_pipeline&#34; class=&#34;discrete&#34;&gt;Pipeline&lt;/h4&gt;
  1445. &lt;div class=&#34;paragraph&#34;&gt;
  1446. &lt;p&gt;Again in the &lt;strong&gt;Central Account&lt;/strong&gt; create a CF stack with the &lt;strong&gt;03central-pipeline.yaml&lt;/strong&gt; template:&lt;/p&gt;
  1447. &lt;/div&gt;
  1448. &lt;div class=&#34;imageblock left&#34;&gt;
  1449. &lt;div class=&#34;content&#34;&gt;
  1450. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/202005/cf3.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/202005/cf3.png&#34; alt=&#34;03central-pipeline.yaml&#34; width=&#34;800&#34; height=&#34;426&#34;/&gt;&lt;/a&gt;
  1451. &lt;/div&gt;
  1452. &lt;/div&gt;
  1453. &lt;hr/&gt;
  1454. &lt;div class=&#34;ulist&#34;&gt;
  1455. &lt;ul&gt;
  1456. &lt;li&gt;
  1457. &lt;p&gt;Stack Name i.e. &lt;em&gt;kbild-serverless-pipeline&lt;/em&gt;&lt;/p&gt;
  1458. &lt;/li&gt;
  1459. &lt;li&gt;
  1460. &lt;p&gt;Project name i.e. &lt;em&gt;serverless&lt;/em&gt;&lt;/p&gt;
  1461. &lt;/li&gt;
  1462. &lt;li&gt;
  1463. &lt;p&gt;RepoBranch → The Repo branch to which the Pipeline Webhook will listen too&lt;/p&gt;
  1464. &lt;/li&gt;
  1465. &lt;/ul&gt;
  1466. &lt;/div&gt;
  1467. &lt;div class=&#34;paragraph&#34;&gt;
  1468. &lt;p&gt;&lt;br/&gt;
  1469. Again wait for the stack deployment to be finished.&lt;/p&gt;
  1470. &lt;/div&gt;
  1471. &lt;div class=&#34;paragraph&#34;&gt;
  1472. &lt;p&gt;Before we run our Code Pipeline for the first time, we have to add our &amp;#34;Hello World&amp;#34; app to the freshly created CodeCommit Repo.&lt;/p&gt;
  1473. &lt;/div&gt;
  1474. &lt;div class=&#34;paragraph&#34;&gt;
  1475. &lt;p&gt;&lt;br/&gt;&lt;/p&gt;
  1476. &lt;/div&gt;
  1477. &lt;h4 id=&#34;_app_deployment&#34; class=&#34;discrete&#34;&gt;App Deployment&lt;/h4&gt;
  1478. &lt;div class=&#34;paragraph&#34;&gt;
  1479. &lt;p&gt;First clone the newly created CodeCommit Repo locally to your machine.&lt;br/&gt;
  1480. (If you have never used git with CodeCommit, go to the repo and click on &amp;#34;Clone URL&amp;#34; at the top → &amp;#34;Connection steps&amp;#34;).&lt;br/&gt;
  1481. I will use SSH:&lt;/p&gt;
  1482. &lt;/div&gt;
  1483. &lt;div class=&#34;listingblock&#34;&gt;
  1484. &lt;div class=&#34;content&#34;&gt;
  1485. &lt;pre class=&#34;highlight&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;git clone ssh://git-codecommit.eu-central-1.amazonaws.com/v1/repos/serverless-ProjectRepo&lt;/code&gt;&lt;/pre&gt;
  1486. &lt;/div&gt;
  1487. &lt;/div&gt;
  1488. &lt;div class=&#34;paragraph&#34;&gt;
  1489. &lt;p&gt;Now add the buildspec.yml and sam-app folder from the the &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;Github repo&lt;/a&gt; to your local clone:&lt;/p&gt;
  1490. &lt;/div&gt;
  1491. &lt;div class=&#34;imageblock left&#34;&gt;
  1492. &lt;div class=&#34;content&#34;&gt;
  1493. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/202005/screen1.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/202005/screen1.png&#34; alt=&#34;03central-pipeline.yaml&#34; width=&#34;800&#34; height=&#34;139&#34;/&gt;&lt;/a&gt;
  1494. &lt;/div&gt;
  1495. &lt;/div&gt;
  1496. &lt;hr/&gt;
  1497. &lt;div class=&#34;paragraph&#34;&gt;
  1498. &lt;p&gt;&lt;br/&gt;
  1499. Now commit and push the new files to the CodeCommit Repo:&lt;/p&gt;
  1500. &lt;/div&gt;
  1501. &lt;div class=&#34;listingblock&#34;&gt;
  1502. &lt;div class=&#34;content&#34;&gt;
  1503. &lt;pre class=&#34;highlight&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;git add .
  1504. git commit -a
  1505. git push&lt;/code&gt;&lt;/pre&gt;
  1506. &lt;/div&gt;
  1507. &lt;/div&gt;
  1508. &lt;div class=&#34;paragraph&#34;&gt;
  1509. &lt;p&gt;This push should trigger the Code Pipeline, so go back to your AWS console of the &amp;#34;Central Account&amp;#34; and open up CodePipeline and the new serverless-Pipeline:&lt;/p&gt;
  1510. &lt;/div&gt;
  1511. &lt;div class=&#34;imageblock&#34;&gt;
  1512. &lt;div class=&#34;content&#34;&gt;
  1513. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/202005/pipe1.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/202005/pipe1.png&#34; alt=&#34;Pipeline&#34; width=&#34;400&#34; height=&#34;324&#34;/&gt;&lt;/a&gt;
  1514. &lt;/div&gt;
  1515. &lt;/div&gt;
  1516. &lt;div class=&#34;paragraph&#34;&gt;
  1517. &lt;p&gt;As you can see the pipeline was just triggered and you can follow how the Pipeline goes through all the stages:&lt;/p&gt;
  1518. &lt;/div&gt;
  1519. &lt;div class=&#34;ulist&#34;&gt;
  1520. &lt;ul&gt;
  1521. &lt;li&gt;
  1522. &lt;p&gt;Build_Templates&lt;/p&gt;
  1523. &lt;/li&gt;
  1524. &lt;li&gt;
  1525. &lt;p&gt;Create_Change_Sets_and_Deploy_to_Dev&lt;/p&gt;
  1526. &lt;/li&gt;
  1527. &lt;li&gt;
  1528. &lt;p&gt;Create_Change_Sets_and_Deploy_to_Test&lt;/p&gt;
  1529. &lt;/li&gt;
  1530. &lt;li&gt;
  1531. &lt;p&gt;Create_Change_Sets_and_Deploy_to_Prod&lt;/p&gt;
  1532. &lt;/li&gt;
  1533. &lt;/ul&gt;
  1534. &lt;/div&gt;
  1535. &lt;div class=&#34;paragraph&#34;&gt;
  1536. &lt;p&gt;&lt;br/&gt;
  1537. If all stages have finished you can logon to your &amp;#34;Dev Account&amp;#34; and go to:&lt;br/&gt;&lt;/p&gt;
  1538. &lt;/div&gt;
  1539. &lt;div class=&#34;paragraph&#34;&gt;
  1540. &lt;p&gt;&lt;em&gt;CloudFormation → cicd-codepipeline-Dev Stack → Outputs&lt;/em&gt;&lt;br/&gt;
  1541. &lt;br/&gt;
  1542. Click on the value for the Key &amp;#34;HelloWorldApi&amp;#34;, this will open the API Gateway Endpoint URL and will show you the &amp;#34;Hello World&amp;#34; example app.&lt;br/&gt;&lt;/p&gt;
  1543. &lt;/div&gt;
  1544. &lt;div class=&#34;paragraph&#34;&gt;
  1545. &lt;p&gt;If everything worked as expected you should see:&lt;/p&gt;
  1546. &lt;/div&gt;
  1547. &lt;div class=&#34;imageblock left&#34;&gt;
  1548. &lt;div class=&#34;content&#34;&gt;
  1549. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/202005/screen3.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/202005/screen3.png&#34; alt=&#34;HelloWorldApp&#34; width=&#34;600&#34; height=&#34;356&#34;/&gt;&lt;/a&gt;
  1550. &lt;/div&gt;
  1551. &lt;/div&gt;
  1552. &lt;hr/&gt;
  1553. &lt;div class=&#34;paragraph&#34;&gt;
  1554. &lt;p&gt;Now go to your Test/Prod Account and open the according API Gateway Endpoint URL as well, you should see environment specific &amp;#34;Hello World&amp;#34; pages:&lt;/p&gt;
  1555. &lt;/div&gt;
  1556. &lt;div class=&#34;imageblock left&#34;&gt;
  1557. &lt;div class=&#34;content&#34;&gt;
  1558. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/202005/screen4.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/202005/screen4.png&#34; alt=&#34;HelloWorldApp&#34; width=&#34;800&#34; height=&#34;618&#34;/&gt;&lt;/a&gt;
  1559. &lt;/div&gt;
  1560. &lt;/div&gt;
  1561. &lt;hr/&gt;
  1562. &lt;div class=&#34;paragraph&#34;&gt;
  1563. &lt;p&gt;&lt;br/&gt;
  1564. &lt;br/&gt;
  1565. I hope that this example helps you on your future CodePipeline journey!&lt;br/&gt;
  1566. &lt;br/&gt;
  1567. In &lt;a href=&#34;https://kbild.ch/blog/2020-5-8-cf_multiple_accounts_regions_part2/&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;Part 2&lt;/a&gt; of this post I will get into more details how the CloudFormation templates work and how you may customize them.
  1568. &lt;br/&gt;
  1569. &lt;br/&gt;
  1570. &lt;br/&gt;&lt;/p&gt;
  1571. &lt;/div&gt;
  1572. </description>
  1573.    </item>
  1574.    
  1575.    <item>
  1576.      <title>Search KBild&#39;s Blog</title>
  1577.      <link>https://kbild.ch/page/search/</link>
  1578.      <pubDate>Fri, 07 Jun 2019 20:22:57 +0200</pubDate>
  1579.      
  1580.      <guid>https://kbild.ch/page/search/</guid>
  1581. <description>
  1582.  
  1583. &lt;script src=&#34;https://kbild.ch/js/lunr.js&#34;&gt;&lt;/script&gt;
  1584. &lt;script type=&#34;text/javascript&#34;&gt;
  1585.  
  1586. // define globale variables
  1587. var idx, searchInput, searchResults = null
  1588. var documents = []
  1589.  
  1590. function renderSearchResults(results){
  1591.  
  1592.    if (results.length &gt; 0) {
  1593.  
  1594.        // show max 10 results
  1595.        if (results.length &gt; 9){
  1596.            results = results.slice(0,10)
  1597.        }
  1598.  
  1599.        // reset search results
  1600.        searchResults.innerHTML = &#39;&#39;
  1601.  
  1602.        // append results
  1603.        results.forEach(result =&gt; {
  1604.        
  1605.            // create result item
  1606.            var article = document.createElement(&#39;article&#39;)
  1607.            article.innerHTML = `
  1608.            &lt;a href=&#34;${result.ref}&#34;&gt;&lt;h3 class=&#34;searchtitle&#34;&gt;${documents[result.ref].title}&lt;/h3&gt;&lt;/a&gt;
  1609.            &lt;p&gt;&lt;a href=&#34;${result.ref}&#34;&gt;${result.ref}&lt;/a&gt;&lt;/p&gt;
  1610.            &lt;p&gt;${documents[result.ref].summary}&lt;/p&gt;
  1611.            &lt;br&gt;
  1612.            `
  1613.            searchResults.appendChild(article)
  1614.        })
  1615.  
  1616.    // if results are empty
  1617.    } else {
  1618.        searchResults.innerHTML = &#39;&lt;p&gt;No results found.&lt;/p&gt;&#39;
  1619.    }
  1620. }
  1621.  
  1622. function registerSearchHandler() {
  1623.  
  1624.    // register on input event
  1625.    searchInput.oninput = function(event) {
  1626.  
  1627.        // remove search results if the user empties the search input field
  1628.        if (searchInput.value == &#39;&#39;) {
  1629.            
  1630.            searchResults.innerHTML = &#39;&#39;
  1631.        } else {
  1632.            
  1633.            // get input value
  1634.            var query = event.target.value
  1635.  
  1636.            // run fuzzy search
  1637.            var results = idx.search(query)
  1638.  
  1639.            // render results
  1640.            renderSearchResults(results)
  1641.        }
  1642.    }
  1643.  
  1644.    // set focus on search input and remove loading placeholder
  1645.    searchInput.focus()
  1646.    searchInput.placeholder = &#39;Search Blog Posts&#39;
  1647. }
  1648.  
  1649. window.onload = function() {
  1650.  
  1651.    // get dom elements
  1652.    searchInput = document.getElementById(&#39;search-input&#39;)
  1653.    searchResults = document.getElementById(&#39;search-results&#39;)
  1654.  
  1655.    // request and index documents
  1656.    fetch(&#39;/blog/index.json&#39;, {
  1657.        method: &#39;get&#39;
  1658.    }).then(
  1659.        res =&gt; res.json()
  1660.    ).then(
  1661.        res =&gt; {
  1662.  
  1663.            // index document
  1664.            idx = lunr(function() {
  1665.                this.ref(&#39;url&#39;)
  1666.                this.field(&#39;title&#39;)
  1667.                this.field(&#39;content&#39;)
  1668.                this.field(&#39;summary&#39;)
  1669.  
  1670.                res.forEach(function(doc) {
  1671.                    this.add(doc)
  1672.                    documents[doc.url] = {
  1673.                        &#39;title&#39;: doc.title,
  1674.                        &#39;content&#39;: doc.content,
  1675.                        &#39;summary&#39;: doc.summary,
  1676.                    }
  1677.                }, this)
  1678.            })
  1679.  
  1680.            // data is loaded, next register handler
  1681.            registerSearchHandler()
  1682.        }
  1683.    ).catch(
  1684.        err =&gt; {
  1685.            searchResults.innerHTML = `&lt;p&gt;${err}&lt;/p&gt;`
  1686.        }
  1687.    )
  1688. }
  1689. &lt;/script&gt;
  1690. &lt;div&gt;
  1691. &lt;input id=&#34;search-input&#34; type=&#34;text&#34; placeholder=&#34;Loading...&#34; name=&#34;search&#34; value&gt;
  1692. &lt;section id=&#34;search-results&#34; class=&#34;search&#34;&gt;&lt;/section&gt;
  1693. &lt;/div&gt;
  1694.  
  1695. </description>
  1696.    </item>
  1697.    
  1698.    <item>
  1699.      <title>CloudFormation example for AWS CodePipeline - Hugo Deployment</title>
  1700.      <link>https://kbild.ch/blog/2019-02-25-pipeline_cloudformation/</link>
  1701.      <pubDate>Tue, 26 Feb 2019 09:30:10 +0000</pubDate>
  1702.      
  1703.      <guid>https://kbild.ch/blog/2019-02-25-pipeline_cloudformation/</guid>
  1704. <description>&lt;div class=&#34;paragraph&#34;&gt;
  1705. &lt;p&gt;I recently blogged on how you can use &lt;a href=&#34;https://kbild.ch/blog/2019-01-31-codepipeline/&#34;&gt;AWS CodePipeline to automatically deploy your Hugo website to AWS S3&lt;/a&gt; and promised a CloudFormation template, so here we go.
  1706. You can find the full template &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/HugoStaticWebpages/Deploy-Pipeline.yaml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;in this GitHub repo&lt;/a&gt;.&lt;/p&gt;
  1707. &lt;/div&gt;
  1708. &lt;div class=&#34;paragraph&#34;&gt;
  1709. &lt;p&gt;If you create a new stack with the template you will be asked for following parameters, let’s look at them in detail:&lt;/p&gt;
  1710. &lt;/div&gt;
  1711. &lt;div class=&#34;imageblock&#34;&gt;
  1712. &lt;div class=&#34;content&#34;&gt;
  1713. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/201902/cloudformation.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/201902/cloudformation.png&#34; alt=&#34;AWS CloudFormation&#34; width=&#34;800&#34; height=&#34;650&#34;/&gt;&lt;/a&gt;
  1714. &lt;/div&gt;
  1715. &lt;/div&gt;
  1716. &lt;hr/&gt;
  1717. &lt;div class=&#34;admonitionblock important&#34;&gt;
  1718. &lt;table&gt;
  1719. &lt;tbody&gt;&lt;tr&gt;
  1720. &lt;td class=&#34;icon&#34;&gt;
  1721. &lt;div class=&#34;title&#34;&gt;Important&lt;/div&gt;
  1722. &lt;/td&gt;
  1723. &lt;td class=&#34;content&#34;&gt;
  1724. The referenced GitHub Repo has to be your Repo with the Hugo source files and the in the previous blog post mentioned &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/HugoStaticWebpages/buildspec.yml&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;buildspec.yml&lt;/a&gt; file &lt;mark&gt;which has to be in this repo&lt;/mark&gt; as well
  1725. &lt;/td&gt;
  1726. &lt;/tr&gt;
  1727. &lt;/tbody&gt;&lt;/table&gt;
  1728. &lt;/div&gt;
  1729. &lt;h3 id=&#34;_needed_parameters&#34; class=&#34;discrete&#34;&gt;Needed parameters&lt;/h3&gt;
  1730. &lt;div class=&#34;ulist&#34;&gt;
  1731. &lt;ul&gt;
  1732. &lt;li&gt;
  1733. &lt;p&gt;GitHub OAuth Token → The Token which will be used to create the webhook in the Repo&lt;/p&gt;
  1734. &lt;/li&gt;
  1735. &lt;li&gt;
  1736. &lt;p&gt;GitHub Owner → The owner of the GitHub Repo&lt;/p&gt;
  1737. &lt;/li&gt;
  1738. &lt;li&gt;
  1739. &lt;p&gt;GitHub Repo → The name of the GitHub Repo&lt;/p&gt;
  1740. &lt;/li&gt;
  1741. &lt;li&gt;
  1742. &lt;p&gt;GitHub Branch → The name of the Branch&lt;/p&gt;
  1743. &lt;/li&gt;
  1744. &lt;li&gt;
  1745. &lt;p&gt;Artifacts S3 BucketName → The name of the S3 bucket where CodePipeline Artifacts will be saved, this bucket will be created!&lt;/p&gt;
  1746. &lt;/li&gt;
  1747. &lt;li&gt;
  1748. &lt;p&gt;Target S3 Bucket → The name of the S3 bucket where your Hugo Website will be deployed, this bucket will be created!&lt;/p&gt;
  1749. &lt;/li&gt;
  1750. &lt;li&gt;
  1751. &lt;p&gt;S3 Bucket with Lambda Code ZIP → The existing S3 bucket &lt;mark&gt;which contains the ZIP file&lt;/mark&gt; of the python script for the CloudFront invalidation. The file has to be named invalidateCloudFront.zip and can be found &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/blob/master/HugoStaticWebpages/invalidateCloudFront.zip&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;here&lt;/a&gt;&lt;/p&gt;
  1752. &lt;/li&gt;
  1753. &lt;li&gt;
  1754. &lt;p&gt;CertificateArn → The Arn of the Certificate which should be used on CloudFront Distribution (has to be created in US East!)&lt;/p&gt;
  1755. &lt;/li&gt;
  1756. &lt;/ul&gt;
  1757. &lt;/div&gt;
  1758. &lt;hr/&gt;
  1759. &lt;div class=&#34;admonitionblock note&#34;&gt;
  1760. &lt;table&gt;
  1761. &lt;tbody&gt;&lt;tr&gt;
  1762. &lt;td class=&#34;icon&#34;&gt;
  1763. &lt;div class=&#34;title&#34;&gt;Note&lt;/div&gt;
  1764. &lt;/td&gt;
  1765. &lt;td class=&#34;content&#34;&gt;
  1766. I tried to generate the certificate with the Template as well but unfortunately there is no easy way doing this → Looks like Terraform offers this functionality, think I will have a look at Terraform soon
  1767. &lt;/td&gt;
  1768. &lt;/tr&gt;
  1769. &lt;/tbody&gt;&lt;/table&gt;
  1770. &lt;/div&gt;
  1771. &lt;div class=&#34;ulist&#34;&gt;
  1772. &lt;ul&gt;
  1773. &lt;li&gt;
  1774. &lt;p&gt;HostedZoneId → The Id of the hosted Zone on Route53, will be used to create the following 2 subdomains/ WebsiteNames&lt;/p&gt;
  1775. &lt;/li&gt;
  1776. &lt;li&gt;
  1777. &lt;p&gt;WebsiteName01 → subdomain1 of the HostedZone&lt;/p&gt;
  1778. &lt;/li&gt;
  1779. &lt;li&gt;
  1780. &lt;p&gt;WebsiteName02  → subdomain2 of the HostedZone&lt;/p&gt;
  1781. &lt;/li&gt;
  1782. &lt;/ul&gt;
  1783. &lt;/div&gt;
  1784. &lt;h3 id=&#34;_created_aws_resources&#34; class=&#34;discrete&#34;&gt;Created AWS Resources&lt;/h3&gt;
  1785. &lt;div class=&#34;paragraph&#34;&gt;
  1786. &lt;p&gt;If you create a Stack out of this Template following resources will be created automatically:&lt;/p&gt;
  1787. &lt;/div&gt;
  1788. &lt;div class=&#34;ulist&#34;&gt;
  1789. &lt;ul&gt;
  1790. &lt;li&gt;
  1791. &lt;p&gt;PipelineArtifactsBucket → AWS::S3::Bucket Artifacts S3 BucketName&lt;/p&gt;
  1792. &lt;/li&gt;
  1793. &lt;li&gt;
  1794. &lt;p&gt;PipelineWebpageBucket → AWS::S3::Bucket Target S3 Bucket&lt;/p&gt;
  1795. &lt;/li&gt;
  1796. &lt;li&gt;
  1797. &lt;p&gt;BucketPolicy → AWS::S3::BucketPolicy which will be used for the S3 Bucket with the Hugo source files and allows PublicRead access&lt;/p&gt;
  1798. &lt;/li&gt;
  1799. &lt;li&gt;
  1800. &lt;p&gt;myCloudfrontDist → AWS::CloudFront::Distribution for the following subdomain names&lt;/p&gt;
  1801. &lt;/li&gt;
  1802. &lt;li&gt;
  1803. &lt;p&gt;domainDNSRecord1 → AWS::Route53::RecordSet WebsiteName01&lt;/p&gt;
  1804. &lt;/li&gt;
  1805. &lt;li&gt;
  1806. &lt;p&gt;domainDNSRecord2 → AWS::Route53::RecordSet WebsiteName02&lt;/p&gt;
  1807. &lt;/li&gt;
  1808. &lt;li&gt;
  1809. &lt;p&gt;CodeBuildProject → AWS::CodeBuild::Project, the actual build project which will be used in the CodePipeline&lt;/p&gt;
  1810. &lt;/li&gt;
  1811. &lt;li&gt;
  1812. &lt;p&gt;CodePipeline → AWS::CodePipeline::Pipeline&lt;/p&gt;
  1813. &lt;/li&gt;
  1814. &lt;li&gt;
  1815. &lt;p&gt;GithubWebhook → AWS::CodePipeline::Webhook&lt;/p&gt;
  1816. &lt;/li&gt;
  1817. &lt;li&gt;
  1818. &lt;p&gt;CreateCodePipelinePolicy → AWS::IAM::ManagedPolicy, the managed policy which will be used for the according role/pipeline&lt;/p&gt;
  1819. &lt;/li&gt;
  1820. &lt;li&gt;
  1821. &lt;p&gt;CodePipelineRole → AWS::IAM::Role with managed policy for CodePipeline&lt;/p&gt;
  1822. &lt;/li&gt;
  1823. &lt;li&gt;
  1824. &lt;p&gt;CreateCodeBuildPolicy → AWS::IAM::ManagedPolicy the managed policy which will be used for the according role for CodeBuild&lt;/p&gt;
  1825. &lt;/li&gt;
  1826. &lt;li&gt;
  1827. &lt;p&gt;CodeBuildRole → AWS::IAM::Role with managed policy for CodeBuild&lt;/p&gt;
  1828. &lt;/li&gt;
  1829. &lt;li&gt;
  1830. &lt;p&gt;CreateLambdaExecutionPolicy → AWS::IAM::ManagedPolicy&lt;/p&gt;
  1831. &lt;/li&gt;
  1832. &lt;li&gt;
  1833. &lt;p&gt;LambdaExecutedRole → AWS::IAM::Role with managed policy to give Lambda enough rights&lt;/p&gt;
  1834. &lt;/li&gt;
  1835. &lt;li&gt;
  1836. &lt;p&gt;LambdaCloudfrontInvalidation → AWS::Lambda::Function python function&lt;/p&gt;
  1837. &lt;/li&gt;
  1838. &lt;/ul&gt;
  1839. &lt;/div&gt;
  1840. &lt;h3 id=&#34;_code_examples&#34; class=&#34;discrete&#34;&gt;Code examples&lt;/h3&gt;
  1841. &lt;div class=&#34;paragraph&#34;&gt;
  1842. &lt;p&gt;Throughout the Template I tried to follow the principle of least privilege.
  1843. I.e. if you look at the &lt;strong&gt;CodeBuild Policy&lt;/strong&gt; you see that CodeBuild is only allowed to work with the created S3 buckets.&lt;/p&gt;
  1844. &lt;/div&gt;
  1845. &lt;div class=&#34;paragraph&#34;&gt;
  1846. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;108&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;CreateCodeBuildPolicy&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1847. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;109&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;AWS::IAM::ManagedPolicy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1848. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;110&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Properties&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1849. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;111&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ManagedPolicyName&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;CodeBuildAccess_Hugo&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1850. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;112&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Description&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;Policy for access to logs and Hugo S3 Buckets&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1851. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;113&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Path&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;/&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1852. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;114&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;PolicyDocument&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1853. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;115&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Version&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;2012-10-17&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1854. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;116&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Statement&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1855. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;117&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Sid&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;VisualEditor0&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1856. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;118&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Effect&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Allow&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1857. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;119&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Action&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;s3:*&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1858. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;120&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Resource&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;[&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1859. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;121&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Join [ &amp;#39;&amp;#39;, [&amp;#39;arn:aws:s3:::&amp;#39;,!Ref TargetS3Bucket] ],&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1860. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;122&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Join [ &amp;#39;&amp;#39;, [&amp;#39;arn:aws:s3:::&amp;#39;,!Ref TargetS3Bucket, &amp;#39;/*&amp;#39;] ],&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1861. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;123&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Join [ &amp;#39;&amp;#39;, [&amp;#39;arn:aws:s3:::&amp;#39;,!Ref ArtifactsBucketName] ],&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1862. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;124&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Join [ &amp;#39;&amp;#39;, [&amp;#39;arn:aws:s3:::&amp;#39;,!Ref ArtifactsBucketName, &amp;#39;/*&amp;#39;] ]&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1863. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;125&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;]&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1864. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;126&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Sid&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;VisualEditor1&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1865. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;127&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Effect&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Allow&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1866. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;128&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Action&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;logs:*&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1867. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;129&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Resource&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;*&amp;#39;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  1868. &lt;/div&gt;
  1869. &lt;div class=&#34;paragraph&#34;&gt;
  1870. &lt;p&gt;Following part creates the &lt;strong&gt;CodePipeline&lt;/strong&gt; with all stages&lt;br/&gt;
  1871. (Source from GitHub, Build on CodeBuild, Deploy to S3 and call Lambda function)
  1872. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;108&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;CodePipeline&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1873. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;109&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;AWS::CodePipeline::Pipeline&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1874. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;110&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Properties&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1875. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;111&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;PipelineForStaticWebpageWithHugo&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1876. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;112&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ArtifactStore&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1877. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;113&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Type&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;S3&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1878. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;114&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Location&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Ref PipelineArtifactsBucket&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1879. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;115&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RestartExecutionOnUpdate&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;true&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1880. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;116&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RoleArn&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;GetAtt CodePipelineRole.Arn&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1881. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;117&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Stages&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1882. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;118&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Source&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1883. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;119&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Actions&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1884. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;120&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Source&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1885. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;121&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;InputArtifacts&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;[]&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1886. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;122&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ActionTypeId&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1887. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;123&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Category&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Source&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1888. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;124&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Owner&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;ThirdParty&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1889. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;125&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Version&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;m&#34;&gt;1&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1890. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;126&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Provider&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;GitHub&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1891. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;127&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;OutputArtifacts&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1892. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;128&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;SourceCode&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1893. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;129&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Configuration&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1894. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;130&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Owner&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Ref GitHubOwner&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1895. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;131&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Repo&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Ref GitHubRepo&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1896. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;132&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Branch&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Ref GitHubBranch&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1897. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;133&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;PollForSourceChanges&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;kc&#34;&gt;false&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1898. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;134&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;OAuthToken&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Ref GitHubOAuthToken&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1899. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;135&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RunOrder&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;m&#34;&gt;1&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1900. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;136&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Build&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1901. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;137&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Actions&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1902. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;138&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;CodeBuild&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1903. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;139&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ActionTypeId&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1904. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;140&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Category&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Build&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1905. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;141&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Owner&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;AWS&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1906. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;142&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Provider&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;CodeBuild&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1907. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;143&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Version&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;1&amp;#39;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1908. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;144&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;InputArtifacts&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1909. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;145&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;SourceCode&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1910. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;146&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;OutputArtifacts&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1911. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;147&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;PublicFiles&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1912. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;148&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Configuration&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1913. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;149&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ProjectName&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Ref CodeBuildProject&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1914. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;150&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RunOrder&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;m&#34;&gt;1&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1915. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;151&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;      &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Deploy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1916. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;152&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Actions&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1917. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;153&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;S3Deploy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1918. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;154&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ActionTypeId&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1919. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;155&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Category&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Deploy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1920. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;156&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Owner&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;AWS&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1921. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;157&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Provider&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;S3&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1922. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;158&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Version&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;1&amp;#39;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1923. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;159&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;InputArtifacts&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1924. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;160&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;PublicFiles&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1925. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;161&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Configuration&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1926. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;162&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;BucketName&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Ref TargetS3Bucket&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1927. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;163&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Extract&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;true&amp;#39;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1928. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;164&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RunOrder&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;m&#34;&gt;1&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1929. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;165&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;- &lt;span class=&#34;nt&#34;&gt;Name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;LambdaDeploy&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1930. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;166&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ActionTypeId&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1931. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;167&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Category&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Invoke&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1932. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;168&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Owner&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;AWS&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1933. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;169&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Provider&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;Lambda&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1934. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;170&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Version&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;1&amp;#39;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1935. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;171&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;Configuration&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1936. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;172&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;FunctionName&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;invalidateCloudfront&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1937. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;173&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;UserParameters&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;!&lt;span class=&#34;l&#34;&gt;Ref myCloudfrontDist&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1938. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;174&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;          &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;RunOrder&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;m&#34;&gt;2&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/p&gt;
  1939. &lt;/div&gt;
  1940. &lt;div class=&#34;paragraph&#34;&gt;
  1941. &lt;p&gt;This is the Lambda function written in python to create the CloudFront invalidation. I needed quiet some time to get the CodePipeline jobId and to get the Id of the CloudFront Distribution out of the UserParameters.&lt;/p&gt;
  1942. &lt;/div&gt;
  1943. &lt;div class=&#34;paragraph&#34;&gt;
  1944. &lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;108&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;l&#34;&gt;import time&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1945. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;109&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;&lt;/span&gt;&lt;span class=&#34;l&#34;&gt;import logging&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1946. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;110&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;&lt;/span&gt;&lt;span class=&#34;l&#34;&gt;from botocore.exceptions import ClientError&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1947. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;111&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;&lt;/span&gt;&lt;span class=&#34;l&#34;&gt;import boto3&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1948. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;112&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;
  1949. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;113&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;&lt;/span&gt;&lt;span class=&#34;l&#34;&gt;LOGGER = logging.getLogger()&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1950. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;114&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;&lt;/span&gt;&lt;span class=&#34;l&#34;&gt;LOGGER.setLevel(logging.INFO)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1951. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;115&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;
  1952. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;116&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;&lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;def codepipeline_success(job_id)&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1953. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;117&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;&amp;#34;&amp;#34;
  1954. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;118&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;s2&#34;&gt;    Puts CodePipeline Success Result
  1955. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;119&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;s2&#34;&gt;    &amp;#34;&amp;#34;&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1956. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;120&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;try&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1957. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;121&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;codepipeline = boto3.client(&amp;#39;codepipeline&amp;#39;)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1958. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;122&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;codepipeline.put_job_success_result(jobId=job_id)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1959. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;123&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;LOGGER.info(&amp;#39;===SUCCESS===&amp;#39;)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1960. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;124&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;return True&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1961. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;125&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;except ClientError as err&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1962. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;126&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;LOGGER.error(&amp;#34;Failed to PutJobSuccessResult for CodePipeline!\n%s&amp;#34;, err)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1963. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;127&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;return False&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1964. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;128&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;
  1965. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;129&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;&lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;def codepipeline_failure(job_id, message)&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1966. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;130&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;try&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1967. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;131&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;codepipeline = boto3.client(&amp;#39;codepipeline&amp;#39;)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1968. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;132&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;codepipeline.put_job_failure_result(&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1969. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;133&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;jobId=job_id,&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1970. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;134&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;failureDetails={&amp;#39;type&amp;#39;: &amp;#39;JobFailed&amp;#39;, &amp;#39;message&amp;#39;: message}&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1971. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;135&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1972. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;136&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;LOGGER.info(&amp;#39;===FAILURE===&amp;#39;)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1973. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;137&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;return True&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1974. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;138&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;except ClientError as err&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1975. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;139&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;LOGGER.error(&amp;#34;Failed to PutJobFailureResult for CodePipeline!\n%s&amp;#34;, err)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1976. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;140&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;return False&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1977. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;141&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;
  1978. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;142&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;
  1979. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;143&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;&lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;def lambda_handler(event, context)&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1980. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;144&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;LOGGER.info(event)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1981. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;145&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;try&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1982. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;146&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;job_id = event[&amp;#39;CodePipeline.job&amp;#39;][&amp;#39;id&amp;#39;]&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1983. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;147&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;distId = event[&amp;#39;CodePipeline.job&amp;#39;][&amp;#39;data&amp;#39;][&amp;#39;actionConfiguration&amp;#39;][&amp;#39;configuration&amp;#39;][&amp;#39;UserParameters&amp;#39;]&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1984. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;148&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;client = boto3.client(&amp;#39;cloudfront&amp;#39;)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1985. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;149&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;invalidation = client.create_invalidation(DistributionId=distId,&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1986. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;150&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;InvalidationBatch={&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1987. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;151&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;&amp;#39;Paths&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;{&lt;span class=&#34;w&#34;&gt;
  1988. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;152&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;&amp;#39;Quantity&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;m&#34;&gt;1&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1989. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;153&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;                    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;&amp;#39;Items&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;p&#34;&gt;[&lt;/span&gt;&lt;span class=&#34;s1&#34;&gt;&amp;#39;/*&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;]&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1990. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;154&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;}&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1991. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;155&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;            &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;&amp;#39;CallerReference&amp;#39;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;str(time.time())&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1992. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;156&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;}&lt;span class=&#34;l&#34;&gt;)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1993. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;157&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;codepipeline_success(job_id)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1994. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;158&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        
  1995. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;159&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;except KeyError as err&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1996. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;160&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;LOGGER.error(&amp;#34;Could not retrieve CodePipeline Job ID!\n%s&amp;#34;, err)&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1997. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;161&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;return False&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
  1998. &lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;ln&#34;&gt;162&lt;/span&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;        &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;codepipeline_failure(job_id, err)&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;
  1999. &lt;/div&gt;
  2000. &lt;div class=&#34;paragraph&#34;&gt;
  2001. &lt;p&gt;Hope this Template helps you on building your own CodePipelines via CloudFormations.
  2002. &lt;br/&gt;
  2003. &lt;br/&gt;&lt;/p&gt;
  2004. &lt;/div&gt;
  2005. </description>
  2006.    </item>
  2007.    
  2008.    <item>
  2009.      <title>Proper Monitoring - How to use Prometheus with your AWS EC2 instances</title>
  2010.      <link>https://kbild.ch/blog/2019-02-18-awsprometheus/</link>
  2011.      <pubDate>Mon, 18 Feb 2019 09:00:10 +0000</pubDate>
  2012.      
  2013.      <guid>https://kbild.ch/blog/2019-02-18-awsprometheus/</guid>
  2014. <description>&lt;div class=&#34;paragraph&#34;&gt;
  2015. &lt;p&gt;As we are operating a lot of servers we need a proper monitoring solution.
  2016. AWS offers CloudWatch which is an almost perfect solution for monitoring your AWS cloud infrastructure.&lt;/p&gt;
  2017. &lt;/div&gt;
  2018. &lt;div class=&#34;paragraph&#34;&gt;
  2019. &lt;p&gt;But we also operate servers on other cloud providers (Softlayer, Azure,…​) and we need one monitoring solution to track all of these servers.&lt;/p&gt;
  2020. &lt;/div&gt;
  2021. &lt;div class=&#34;paragraph&#34;&gt;
  2022. &lt;p&gt;As you might know, I’m a huge fan of &lt;a href=&#34;https://prometheus.io&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;Prometheus&lt;/a&gt;, the only graduated Monitoring project of &lt;a href=&#34;https://www.cncf.io&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;CNCF&lt;/a&gt;.&lt;/p&gt;
  2023. &lt;/div&gt;
  2024. &lt;div class=&#34;paragraph&#34;&gt;
  2025. &lt;p&gt;If you want to know more what Prometheus is and how you can use it I recommend you to watch this YouTube Movie &lt;a href=&#34;https://www.youtube.com/watch?v=PDxcEzu62jk&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;&amp;#34;Monitoring, the Prometheus Way&amp;#34; &lt;/a&gt; where Julius Volz, Co-Founder Prometheus, gives a very good introduction into the topic.&lt;/p&gt;
  2026. &lt;/div&gt;
  2027. &lt;div class=&#34;paragraph&#34;&gt;
  2028. &lt;p&gt;I also gave a talk on Prometheus and how to use it with IBM Connections last year at the DNUG event in Darmstadt. It’s only available in German but have a look at the presentation if you are interested in how you can monitor IBM Connections with Prometheus:
  2029.  
  2030.    &lt;iframe
  2031.        src=&#34;//www.slideshare.net/slideshow/embed_code/key/yCxxxpsRo0YMyr&#34;
  2032.        height=&#34;485&#34;
  2033.        width=&#34;595&#34;
  2034.        frameborder=&#34;0&#34;
  2035.        marginwidth=&#34;0&#34;
  2036.        marginheight=&#34;0&#34;
  2037.        scrolling=&#34;no&#34;
  2038.        style=&#34;border: 1px solid #CCC; border-width: 1px; margin-bottom: 20px; width: 82%;&#34;
  2039.        allowfullscreen=&#34;true&#34;&gt;
  2040.    &lt;/iframe&gt;
  2041. &lt;/p&gt;
  2042. &lt;/div&gt;
  2043. &lt;div class=&#34;paragraph&#34;&gt;
  2044. &lt;p&gt;So how can we use Prometheus together with our AWS Cloud Infrastructure?&lt;/p&gt;
  2045. &lt;/div&gt;
  2046. &lt;div class=&#34;paragraph&#34;&gt;
  2047. &lt;p&gt;We will need following parts:&lt;/p&gt;
  2048. &lt;/div&gt;
  2049. &lt;div class=&#34;ulist&#34;&gt;
  2050. &lt;ul&gt;
  2051. &lt;li&gt;
  2052. &lt;p&gt;Agents on the EC2 instances (called &lt;a href=&#34;https://github.com/prometheus/node_exporter&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;node_exporter&lt;/a&gt;)&lt;/p&gt;
  2053. &lt;/li&gt;
  2054. &lt;li&gt;
  2055. &lt;p&gt;Prometheus with configured AWS Service Discovery (in this case only for EC2 instances)&lt;/p&gt;
  2056. &lt;/li&gt;
  2057. &lt;/ul&gt;
  2058. &lt;/div&gt;
  2059. &lt;div class=&#34;sect1&#34;&gt;
  2060. &lt;h2 id=&#34;_node_exporter_on_ec2_instances&#34;&gt;node_exporter on EC2 instances&lt;/h2&gt;
  2061. &lt;div class=&#34;sectionbody&#34;&gt;
  2062. &lt;div class=&#34;paragraph&#34;&gt;
  2063. &lt;p&gt;Installing the node_exporter on EC2 instances is straight forward, just use following User data script:&lt;/p&gt;
  2064. &lt;/div&gt;
  2065. &lt;div class=&#34;listingblock&#34;&gt;
  2066. &lt;div class=&#34;content&#34;&gt;
  2067. &lt;pre class=&#34;highlight&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;useradd -m -s /bin/bash prometheus
  2068. # (or adduser --disabled-password --gecos &amp;#34;&amp;#34; prometheus)
  2069.  
  2070. # Download node_exporter release from original repo
  2071. curl -L -O  https://github.com/prometheus/node_exporter/releases/download/v0.17.0/node_exporter-0.17.0.linux-amd64.tar.gz
  2072.  
  2073. tar -xzvf node_exporter-0.17.0.linux-amd64.tar.gz
  2074. mv node_exporter-0.17.0.linux-amd64 /home/prometheus/node_exporter
  2075. rm node_exporter-0.17.0.linux-amd64.tar.gz
  2076. chown -R prometheus:prometheus /home/prometheus/node_exporter
  2077.  
  2078. # Add node_exporter as systemd service
  2079. tee -a /etc/systemd/system/node_exporter.service &amp;lt;&amp;lt; END
  2080. [Unit]
  2081. Description=Node Exporter
  2082. Wants=network-online.target
  2083. After=network-online.target
  2084. [Service]
  2085. User=prometheus
  2086. ExecStart=/home/prometheus/node_exporter/node_exporter
  2087. [Install]
  2088. WantedBy=default.target
  2089. END
  2090.  
  2091. systemctl daemon-reload
  2092. systemctl start node_exporter
  2093. systemctl enable node_exporter&lt;/code&gt;&lt;/pre&gt;
  2094. &lt;/div&gt;
  2095. &lt;/div&gt;
  2096. &lt;div class=&#34;paragraph&#34;&gt;
  2097. &lt;p&gt;The Prometheus server will scrape the node_exporter on the standard port 9100&lt;br/&gt;
  2098. → don’t forget to add this port to your instance Security Group and grant access to the Prometheus Server&lt;/p&gt;
  2099. &lt;/div&gt;
  2100. &lt;div class=&#34;paragraph&#34;&gt;
  2101. &lt;p&gt;You may test if the node_exporter is running as expected by running following command locally on the EC2 instance:
  2102. curl &lt;a href=&#34;http://127.0.0.1:9100/metrics&#34; class=&#34;bare&#34;&gt;http://127.0.0.1:9100/metrics&lt;/a&gt;&lt;/p&gt;
  2103. &lt;/div&gt;
  2104. &lt;div class=&#34;paragraph&#34;&gt;
  2105. &lt;p&gt;If everything works you should get back the metrics of your server&lt;/p&gt;
  2106. &lt;/div&gt;
  2107. &lt;div class=&#34;listingblock&#34;&gt;
  2108. &lt;div class=&#34;content&#34;&gt;
  2109. &lt;pre class=&#34;highlight&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;# HELP go_gc_duration_seconds A summary of the GC invocation durations.
  2110. # TYPE go_gc_duration_seconds summary
  2111. go_gc_duration_seconds{quantile=&amp;#34;0&amp;#34;} 2.8809e-05
  2112. go_gc_duration_seconds{quantile=&amp;#34;0.25&amp;#34;} 3.7675e-05
  2113. go_gc_duration_seconds{quantile=&amp;#34;0.5&amp;#34;} 4.8971e-05
  2114. go_gc_duration_seconds{quantile=&amp;#34;0.75&amp;#34;} 6.1912e-05
  2115. go_gc_duration_seconds{quantile=&amp;#34;1&amp;#34;} 0.000266006
  2116. go_gc_duration_seconds_sum 0.667055045
  2117. go_gc_duration_seconds_count 11450
  2118. # HELP go_goroutines Number of goroutines that currently exist.
  2119. # TYPE go_goroutines gauge
  2120. go_goroutines 9
  2121. ...&lt;/code&gt;&lt;/pre&gt;
  2122. &lt;/div&gt;
  2123. &lt;/div&gt;
  2124. &lt;div class=&#34;paragraph&#34;&gt;
  2125. &lt;p&gt;The same will be scraped and recorded by the Prometheus server.&lt;/p&gt;
  2126. &lt;/div&gt;
  2127. &lt;/div&gt;
  2128. &lt;/div&gt;
  2129. &lt;div class=&#34;sect1&#34;&gt;
  2130. &lt;h2 id=&#34;_prometheus_aws_service_discovery&#34;&gt;Prometheus AWS Service Discovery&lt;/h2&gt;
  2131. &lt;div class=&#34;sectionbody&#34;&gt;
  2132. &lt;div class=&#34;paragraph&#34;&gt;
  2133. &lt;p&gt;The Prometheus server will talk to directly to the AWS API so you need to create a user with programmatic access and add following permission:&lt;/p&gt;
  2134. &lt;/div&gt;
  2135. &lt;div class=&#34;listingblock&#34;&gt;
  2136. &lt;div class=&#34;content&#34;&gt;
  2137. &lt;pre class=&#34;highlight&#34;&gt;&lt;code class=&#34;language-json&#34; data-lang=&#34;json&#34;&gt;{
  2138.    &amp;#34;Version&amp;#34;: &amp;#34;2012-10-17&amp;#34;,
  2139.    &amp;#34;Statement&amp;#34;: [
  2140.        {
  2141.            &amp;#34;Effect&amp;#34;: &amp;#34;Allow&amp;#34;,
  2142.            &amp;#34;Action&amp;#34;: &amp;#34;ec2:DescribeInstances&amp;#34;,
  2143.            &amp;#34;Resource&amp;#34;: &amp;#34;*&amp;#34;
  2144.        }
  2145.    ]
  2146. }&lt;/code&gt;&lt;/pre&gt;
  2147. &lt;/div&gt;
  2148. &lt;/div&gt;
  2149. &lt;div class=&#34;paragraph&#34;&gt;
  2150. &lt;p&gt;→ The Prometheus server can get all metadata of the EC2 instances like IP addresses or tags&lt;/p&gt;
  2151. &lt;/div&gt;
  2152. &lt;div class=&#34;paragraph&#34;&gt;
  2153. &lt;p&gt;On the Prometheus server a scrape target has to be added to the &lt;strong&gt;prometheus.yml&lt;/strong&gt; file with the access and secret key of the added user.
  2154. You can do some &lt;a href=&#34;https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;relabeling magic&lt;/a&gt; which lets you reuse your EC2 tags and metadata in Prometheus which is very nice.&lt;br/&gt;
  2155. I.e. here we take the &lt;strong&gt;ec2_tag_name&lt;/strong&gt; as &lt;strong&gt;instance&lt;/strong&gt; value and we add two additional tags (&lt;strong&gt;customer,role&lt;/strong&gt;) which we get from the &lt;strong&gt;ec2_tag_customer&lt;/strong&gt; and &lt;strong&gt;ec2_tag_role&lt;/strong&gt;&lt;/p&gt;
  2156. &lt;/div&gt;
  2157. &lt;div class=&#34;listingblock&#34;&gt;
  2158. &lt;div class=&#34;content&#34;&gt;
  2159. &lt;pre class=&#34;highlight&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;  - job_name: &amp;#39;node&amp;#39;
  2160.    ec2_sd_configs:
  2161.      - region: YOURREGION
  2162.        access_key: YOURACCESSKEY
  2163.        secret_key: YOURSECRETKEY
  2164.        port: 9100
  2165.        refresh_interval: 1m
  2166.    relabel_configs:
  2167.      - source_labels:
  2168.        - &amp;#39;__meta_ec2_tag_Name&amp;#39;
  2169.        target_label: &amp;#39;instance&amp;#39;
  2170.      - source_labels:
  2171.        - &amp;#39;__meta_ec2_tag_customer&amp;#39;
  2172.        target_label:  &amp;#39;customer&amp;#39;
  2173.      - source_labels:
  2174.        - &amp;#39;__meta_ec2_tag_role&amp;#39;
  2175.        target_label:  &amp;#39;role&amp;#39;&lt;/code&gt;&lt;/pre&gt;
  2176. &lt;/div&gt;
  2177. &lt;/div&gt;
  2178. &lt;div class=&#34;paragraph&#34;&gt;
  2179. &lt;p&gt;The Prometheus server will now get the private IP addresses of all of your EC2 instances&lt;br/&gt;
  2180. (by default the private IPs, but you can use the public ones as well, see &lt;a href=&#34;https://prometheus.io/docs/prometheus/latest/configuration/configuration/#ec2_sd_config&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;ec2_sd_config documentation&lt;/a&gt;)&lt;/p&gt;
  2181. &lt;/div&gt;
  2182. &lt;div class=&#34;paragraph&#34;&gt;
  2183. &lt;p&gt;If you want to see which targets Prometheus gets through the Service Discovery browse to following URL of you Prometheus server:&lt;br/&gt;
  2184. &lt;strong&gt;-https://prometheus.server.com/service-discovery&lt;/strong&gt;&lt;/p&gt;
  2185. &lt;/div&gt;
  2186. &lt;div class=&#34;paragraph&#34;&gt;
  2187. &lt;p&gt;Here you will see all your EC2 instances with their metadata and which data is reused in Prometheus:&lt;br/&gt;&lt;/p&gt;
  2188. &lt;/div&gt;
  2189. &lt;div class=&#34;imageblock&#34;&gt;
  2190. &lt;div class=&#34;content&#34;&gt;
  2191. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/201902/Prometheus_SD.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/201902/Prometheus_SD.png&#34; alt=&#34;Prometheus Service Discovery&#34; width=&#34;800&#34; height=&#34;400&#34;/&gt;&lt;/a&gt;
  2192. &lt;/div&gt;
  2193. &lt;/div&gt;
  2194. &lt;div class=&#34;paragraph&#34;&gt;
  2195. &lt;p&gt;&lt;br/&gt;
  2196. &lt;br/&gt;&lt;/p&gt;
  2197. &lt;/div&gt;
  2198. &lt;/div&gt;
  2199. &lt;/div&gt;
  2200. &lt;div class=&#34;sect1&#34;&gt;
  2201. &lt;h2 id=&#34;_graphs_and_dashboards&#34;&gt;Graphs and Dashboards&lt;/h2&gt;
  2202. &lt;div class=&#34;sectionbody&#34;&gt;
  2203. &lt;div class=&#34;paragraph&#34;&gt;
  2204. &lt;p&gt;We defined that the metrics are scraped every minute and after some minutes we can see the results in the Prometheus UI:&lt;/p&gt;
  2205. &lt;/div&gt;
  2206. &lt;div class=&#34;imageblock&#34;&gt;
  2207. &lt;div class=&#34;content&#34;&gt;
  2208. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/201902/Prometheus_Graph.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/201902/Prometheus_Graph.png&#34; alt=&#34;Prometheus Graph&#34; width=&#34;800&#34; height=&#34;400&#34;/&gt;&lt;/a&gt;
  2209. &lt;/div&gt;
  2210. &lt;/div&gt;
  2211. &lt;div class=&#34;paragraph&#34;&gt;
  2212. &lt;p&gt;As you can see here we even get the data for the instance memory which we don’t have if we use CloudWatch for Monitoring.
  2213. If you wan’t to have real dashboards for your monitoring just add Grafana which is natively supporting Prometheus as Data Source and you can create such nice dashboards:&lt;/p&gt;
  2214. &lt;/div&gt;
  2215. &lt;div class=&#34;imageblock&#34;&gt;
  2216. &lt;div class=&#34;content&#34;&gt;
  2217. &lt;a class=&#34;image&#34; href=&#34;https://kbild.ch/201902/Grafana_Dashboard.png&#34;&gt;&lt;img src=&#34;https://kbild.ch/201902/Grafana_Dashboard.png&#34; alt=&#34;Grafana Dashboard&#34; width=&#34;800&#34; height=&#34;423&#34;/&gt;&lt;/a&gt;
  2218. &lt;/div&gt;
  2219. &lt;/div&gt;
  2220. &lt;div class=&#34;paragraph&#34;&gt;
  2221. &lt;p&gt;&lt;br/&gt;
  2222. Maybe you know now why I’m a big fan of Prometheus and as someone which is also using Prometheus to monitor his Kubernetes environment I can tell you we just scratched on the surface of what is possible with Prometheus.
  2223. &lt;br/&gt;&lt;/p&gt;
  2224. &lt;/div&gt;
  2225. &lt;/div&gt;
  2226. &lt;/div&gt;
  2227. </description>
  2228.    </item>
  2229.    
  2230.    <item>
  2231.      <title>CloudFormation Template: Tag AWS Volumes for Lifecycle Manager Backups </title>
  2232.      <link>https://kbild.ch/blog/2019-02-11-lifecycle/</link>
  2233.      <pubDate>Tue, 12 Feb 2019 15:41:10 +0000</pubDate>
  2234.      
  2235.      <guid>https://kbild.ch/blog/2019-02-11-lifecycle/</guid>
  2236. <description>&lt;div class=&#34;paragraph&#34;&gt;
  2237. &lt;p&gt;If you wan’t a simple AWS Backup solution you can use AWS Lifecycle Manager to create snapshots from your AWS EC2 volumes.&lt;br/&gt;&lt;/p&gt;
  2238. &lt;/div&gt;
  2239. &lt;div class=&#34;paragraph&#34;&gt;
  2240. &lt;p&gt;Lifecycle Manager is easy to use and even gives you some retention rules, no scripting needed for your Backups at all.&lt;/p&gt;
  2241. &lt;/div&gt;
  2242. &lt;div class=&#34;paragraph&#34;&gt;
  2243. &lt;p&gt;You can easily define which target volumes Lifecycle Manager should snapshot through tags on your volumes.&lt;br/&gt;&lt;/p&gt;
  2244. &lt;/div&gt;
  2245. &lt;div class=&#34;sect1&#34;&gt;
  2246. &lt;h2 id=&#34;_lifecycle_manager_snapshot_lifecycle_policy&#34;&gt;Lifecycle Manager - Snapshot Lifecycle Policy&lt;/h2&gt;
  2247. &lt;div class=&#34;sectionbody&#34;&gt;
  2248. &lt;div class=&#34;paragraph&#34;&gt;
  2249. &lt;p&gt;In following example we will take snapshots all 24h of all volumes which are tagged &lt;code&gt;backupid: AUT01&lt;/code&gt; between 09 and 10 UTC and will retain 7 snapshots.&lt;/p&gt;
  2250. &lt;/div&gt;
  2251. &lt;hr/&gt;
  2252. &lt;div class=&#34;imageblock&#34;&gt;
  2253. &lt;div class=&#34;content&#34;&gt;
  2254. &lt;img src=&#34;https://kbild.ch/201902/Lifecycle.png&#34; alt=&#34;AWS Lifecycle Manager&#34;/&gt;
  2255. &lt;/div&gt;
  2256. &lt;/div&gt;
  2257. &lt;hr/&gt;
  2258. &lt;div class=&#34;paragraph&#34;&gt;
  2259. &lt;p&gt;Usually we use CloudFormation to create our AWS environments and our EC2 instances. Unfortunately the tags you use for your EC2 instances are not automatically added to the according volumes of your instance. Bummer!&lt;/p&gt;
  2260. &lt;/div&gt;
  2261. &lt;div class=&#34;paragraph&#34;&gt;
  2262. &lt;p&gt;This means we have to find a way to tag the instance volumes right after creation and of course easiest way to do this is using some magic in a User data script.&lt;/p&gt;
  2263. &lt;/div&gt;
  2264. &lt;/div&gt;
  2265. &lt;/div&gt;
  2266. &lt;div class=&#34;sect1&#34;&gt;
  2267. &lt;h2 id=&#34;_needed_user_data_script&#34;&gt;Needed User data script&lt;/h2&gt;
  2268. &lt;div class=&#34;sectionbody&#34;&gt;
  2269. &lt;div class=&#34;paragraph&#34;&gt;
  2270. &lt;p&gt;Following script may be used as User data script:&lt;/p&gt;
  2271. &lt;/div&gt;
  2272. &lt;div class=&#34;listingblock&#34;&gt;
  2273. &lt;div class=&#34;content&#34;&gt;
  2274. &lt;pre class=&#34;highlight&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;aws ec2 create-tags --resources $(aws ec2 describe-volumes --filters Name=attachment.instance-id,Values=$(curl -s http://169.254.169.254/latest/meta-data/instance-id) --query &amp;#39;Volumes[*].[VolumeId]&amp;#39; --region=eu-central-1 --out text | cut -f 1) --tags Key=$Key,Value=$Value --region eu-central-1&lt;/code&gt;&lt;/pre&gt;
  2275. &lt;/div&gt;
  2276. &lt;/div&gt;
  2277. &lt;div class=&#34;paragraph&#34;&gt;
  2278. &lt;p&gt;There are two parts in this script:&lt;/p&gt;
  2279. &lt;/div&gt;
  2280. &lt;div class=&#34;ulist&#34;&gt;
  2281. &lt;ul&gt;
  2282. &lt;li&gt;
  2283. &lt;p&gt;Getting the VolumeIds of the volumes with the help of the local server metadata&lt;/p&gt;
  2284. &lt;div class=&#34;listingblock&#34;&gt;
  2285. &lt;div class=&#34;content&#34;&gt;
  2286. &lt;pre class=&#34;highlight&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;aws ec2 describe-volumes --filters Name=attachment.instance-id,Values=$(curl -s http://169.254.169.254/latest/meta-data/instance-id) --query &amp;#39;Volumes[*].[VolumeId]&amp;#39; --region=eu-central-1 --out text&lt;/code&gt;&lt;/pre&gt;
  2287. &lt;/div&gt;
  2288. &lt;/div&gt;
  2289. &lt;/li&gt;
  2290. &lt;/ul&gt;
  2291. &lt;/div&gt;
  2292. &lt;div class=&#34;admonitionblock tip&#34;&gt;
  2293. &lt;table&gt;
  2294. &lt;tbody&gt;&lt;tr&gt;
  2295. &lt;td class=&#34;icon&#34;&gt;
  2296. &lt;div class=&#34;title&#34;&gt;Tip&lt;/div&gt;
  2297. &lt;/td&gt;
  2298. &lt;td class=&#34;content&#34;&gt;
  2299. You can add a filter for device names as well, i.e. you only want to tag/backup your data volume which is mounted as /dev/xvdb then add following right before the &amp;#34;--query&amp;#34; statement
  2300. &lt;/td&gt;
  2301. &lt;/tr&gt;
  2302. &lt;/tbody&gt;&lt;/table&gt;
  2303. &lt;/div&gt;
  2304. &lt;div class=&#34;listingblock&#34;&gt;
  2305. &lt;div class=&#34;content&#34;&gt;
  2306. &lt;pre class=&#34;highlight&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;Name=attachment.device,Values=/dev/xvdb&lt;/code&gt;&lt;/pre&gt;
  2307. &lt;/div&gt;
  2308. &lt;/div&gt;
  2309. &lt;div class=&#34;ulist&#34;&gt;
  2310. &lt;ul&gt;
  2311. &lt;li&gt;
  2312. &lt;p&gt;Tag these Volumes with the provided key and value&lt;/p&gt;
  2313. &lt;div class=&#34;listingblock&#34;&gt;
  2314. &lt;div class=&#34;content&#34;&gt;
  2315. &lt;pre class=&#34;highlight&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;aws ec2 create-tags --resources VOLUMEIDS --tags Key=$Key,Value=$Value --region eu-central-1&lt;/code&gt;&lt;/pre&gt;
  2316. &lt;/div&gt;
  2317. &lt;/div&gt;
  2318. &lt;/li&gt;
  2319. &lt;/ul&gt;
  2320. &lt;/div&gt;
  2321. &lt;div class=&#34;paragraph&#34;&gt;
  2322. &lt;p&gt;As you can see we are using an EC2 instance in the eu-central-1 region, you have to change this to the region you are using.&lt;/p&gt;
  2323. &lt;/div&gt;
  2324. &lt;div class=&#34;paragraph&#34;&gt;
  2325. &lt;p&gt;The EC2 instance needs an IAM role with sufficient rights to get the volume id’s and to tag the volumes. We will add following policy to this role:&lt;/p&gt;
  2326. &lt;/div&gt;
  2327. &lt;div class=&#34;listingblock&#34;&gt;
  2328. &lt;div class=&#34;content&#34;&gt;
  2329. &lt;pre class=&#34;highlight&#34;&gt;&lt;code class=&#34;language-json&#34; data-lang=&#34;json&#34;&gt;{
  2330.    &amp;#34;Version&amp;#34;: &amp;#34;2012-10-17&amp;#34;,
  2331.    &amp;#34;Statement&amp;#34;: [
  2332.        {
  2333.            &amp;#34;Action&amp;#34;: &amp;#34;ec2:Describe*&amp;#34;,
  2334.            &amp;#34;Resource&amp;#34;: &amp;#34;*&amp;#34;,
  2335.            &amp;#34;Effect&amp;#34;: &amp;#34;Allow&amp;#34;
  2336.        },
  2337.        {
  2338.            &amp;#34;Action&amp;#34;: &amp;#34;ec2:CreateTags&amp;#34;,
  2339.            &amp;#34;Resource&amp;#34;: &amp;#34;*&amp;#34;,
  2340.            &amp;#34;Effect&amp;#34;: &amp;#34;Allow&amp;#34;
  2341.        }
  2342.    ]
  2343. }&lt;/code&gt;&lt;/pre&gt;
  2344. &lt;/div&gt;
  2345. &lt;/div&gt;
  2346. &lt;/div&gt;
  2347. &lt;/div&gt;
  2348. &lt;div class=&#34;sect1&#34;&gt;
  2349. &lt;h2 id=&#34;_lifecycle_policy&#34;&gt;Lifecycle Policy&lt;/h2&gt;
  2350. &lt;div class=&#34;sectionbody&#34;&gt;
  2351. &lt;div class=&#34;paragraph&#34;&gt;
  2352. &lt;p&gt;Final step is to add the Snapshot Lifecycle Policy with the needed parameters (TargetTags…​)&lt;/p&gt;
  2353. &lt;/div&gt;
  2354. &lt;div class=&#34;listingblock&#34;&gt;
  2355. &lt;div class=&#34;content&#34;&gt;
  2356. &lt;pre class=&#34;highlight&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;  BasicLifecyclePolicy:
  2357.    Type: &amp;#34;AWS::DLM::LifecyclePolicy&amp;#34;
  2358.    Properties:
  2359.      Description: &amp;#34;Lifecycle Policy using CloudFormation&amp;#34;
  2360.      State: &amp;#34;ENABLED&amp;#34;
  2361.      ExecutionRoleArn: !GetAtt
  2362.        - lifecycleRole
  2363.        - Arn
  2364.      PolicyDetails:
  2365.        ResourceTypes:
  2366.          - &amp;#34;VOLUME&amp;#34;
  2367.        TargetTags:
  2368.          -
  2369.            Key: &amp;#34;backupid&amp;#34;
  2370.            Value: &amp;#34;AUT01&amp;#34;
  2371.        Schedules:
  2372.          -
  2373.            Name: &amp;#34;Daily Snapshots&amp;#34;
  2374.            TagsToAdd:
  2375.              -
  2376.                Key: &amp;#34;type&amp;#34;
  2377.                Value: &amp;#34;DailySnapshot&amp;#34;
  2378.            CreateRule:
  2379.              Interval: 24
  2380.              IntervalUnit: &amp;#34;HOURS&amp;#34;
  2381.              Times:
  2382.                - &amp;#34;09:00&amp;#34;
  2383.            RetainRule:
  2384.              Count: 7
  2385.            CopyTags: true&lt;/code&gt;&lt;/pre&gt;
  2386. &lt;/div&gt;
  2387. &lt;/div&gt;
  2388. &lt;div class=&#34;paragraph&#34;&gt;
  2389. &lt;p&gt;As you can see an execution role is needed as well (with proper policy attached).
  2390. You will find this role and all additional needed resources in the full CloudFormation template on &lt;a href=&#34;https://github.com/kbild/AWS_Cloudformation_Examples/tree/master/Volume_Tagging&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;Github&lt;/a&gt;.&lt;/p&gt;
  2391. &lt;/div&gt;
  2392. &lt;div class=&#34;paragraph&#34;&gt;
  2393. &lt;p&gt;Feedback is always welcome!&lt;/p&gt;
  2394. &lt;/div&gt;
  2395. &lt;/div&gt;
  2396. &lt;/div&gt;
  2397. </description>
  2398.    </item>
  2399.    
  2400.    <item>
  2401.      <title>Use AWS CodePipeline to automatically deploy your Hugo website to AWS S3</title>
  2402.      <link>https://kbild.ch/blog/2019-01-31-codepipeline/</link>
  2403.      <pubDate>Tue, 05 Feb 2019 10:17:10 +0000</pubDate>
  2404.      
  2405.      <guid>https://kbild.ch/blog/2019-01-31-codepipeline/</guid>
  2406. <description>&lt;div class=&#34;paragraph&#34;&gt;
  2407. &lt;p&gt;So I have a &lt;a href=&#34;https://gohugo.io/&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;Hugo&lt;/a&gt; website now but deploying the generated HTML files to my AWS S3 bucket and invalidating my AWS Cloudfront deployment is very time consuming.&lt;/p&gt;
  2408. &lt;/div&gt;
  2409. &lt;div class=&#34;paragraph&#34;&gt;
  2410. &lt;p&gt;Therefore I planned to have a AWS Code Pipeline which helps me in this process.
  2411. Following steps are needed:&lt;/p&gt;
  2412. &lt;/div&gt;
  2413. &lt;div class=&#34;imageblock&#34;&gt;
  2414. &lt;div class=&#34;content&#34;&gt;
  2415. &lt;img src=&#34;https://kbild.ch/201902/AWSCodePipeline01.png&#34; alt=&#34;AWS CodePipeline&#34;/&gt;
  2416. &lt;/div&gt;
  2417. &lt;/div&gt;
  2418. &lt;div class=&#34;paragraph&#34;&gt;
  2419. &lt;p&gt;Reading guides from other Bloggers (&lt;a href=&#34;https://alimac.io/static-websites-with-s3-and-hugo-part-1/&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;alimac.io&lt;/a&gt;, &lt;a href=&#34;https://medium.com/@yagonobre/automatically-invalidate-cloudfront-cache-for-site-hosted-on-s3-3c7818099868&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;YagoYns&lt;/a&gt;, &lt;a href=&#34;https://github.com/symphoniacloud/github-codepipeline&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;Symphonia &lt;/a&gt;) gave me a good starting point to build my own solution based on AWS CodePipeline.&lt;/p&gt;
  2420. &lt;/div&gt;
  2421. &lt;div class=&#34;paragraph&#34;&gt;
  2422. &lt;p&gt;I will publish a complete CloudFormation script in one of the following blog posts but will only talk about the &lt;a href=&#34;https://aws.amazon.com/codebuild/&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;AWS CodeBuild&lt;/a&gt; part today.&lt;/p&gt;
  2423. &lt;/div&gt;
  2424. &lt;div class=&#34;paragraph&#34;&gt;
  2425. &lt;p&gt;During the Build process I need a functionality which generates the static HTML files based on my Hugo and asciidoc files in my GitHub repo. The easiest way getting this functionality is to use a Docker container which has Hugo and asciidoctor installed.&lt;/p&gt;
  2426. &lt;/div&gt;
  2427. &lt;div class=&#34;paragraph&#34;&gt;
  2428. &lt;p&gt;So let’s start this by creating a build project in AWS CodeBuild by clicking on &lt;code&gt;Create project&lt;/code&gt; and defining a ProjectName &lt;code&gt;BuildContainerForHTML&lt;/code&gt;.&lt;/p&gt;
  2429. &lt;/div&gt;
  2430. &lt;div class=&#34;paragraph&#34;&gt;
  2431. &lt;p&gt;During the creation of your build project you can choose either if you want to use an AWS Managed Docker Image or if you want to use a Custom Image:&lt;/p&gt;
  2432. &lt;/div&gt;
  2433. &lt;div class=&#34;imageblock&#34;&gt;
  2434. &lt;div class=&#34;content&#34;&gt;
  2435. &lt;img src=&#34;https://kbild.ch/201902/DockerImage.png&#34; alt=&#34;Which Docker Image&#34;/&gt;
  2436. &lt;/div&gt;
  2437. &lt;/div&gt;
  2438. &lt;div class=&#34;paragraph&#34;&gt;
  2439. &lt;p&gt;Here we will choose &lt;code&gt;Managed Image&lt;/code&gt; and will use following parameters:&lt;/p&gt;
  2440. &lt;/div&gt;
  2441. &lt;div class=&#34;imageblock&#34;&gt;
  2442. &lt;div class=&#34;content&#34;&gt;
  2443. &lt;img src=&#34;https://kbild.ch/201902/DockerImage02.png&#34; alt=&#34;Image Settings&#34;/&gt;
  2444. &lt;/div&gt;
  2445. &lt;/div&gt;
  2446. &lt;div class=&#34;paragraph&#34;&gt;
  2447. &lt;p&gt;This means we will use the standard AWS Ubuntu 14.04 Base Docker container, so nothing installed per default.&lt;/p&gt;
  2448. &lt;/div&gt;
  2449. &lt;div class=&#34;paragraph&#34;&gt;
  2450. &lt;p&gt;Now we need to install the needed software which is defined through a  file called buildspec.yml (which should be placed in the source code root directory → GitHub repo).&lt;br/&gt;&lt;/p&gt;
  2451. &lt;/div&gt;
  2452. &lt;div class=&#34;paragraph&#34;&gt;
  2453. &lt;p&gt;Hardest part for me was to find out how the &lt;a href=&#34;https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;buildspec.yml&lt;/a&gt; has to look like. This buildspec file is used to create the build commands which will be used in the docker container.&lt;br/&gt;
  2454. As you can see I’m only using two phases in this example and define the output artifact:&lt;/p&gt;
  2455. &lt;/div&gt;
  2456. &lt;div class=&#34;listingblock&#34;&gt;
  2457. &lt;div class=&#34;title&#34;&gt;buildspec.yml&lt;/div&gt;
  2458. &lt;div class=&#34;content&#34;&gt;
  2459. &lt;pre class=&#34;highlight&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;version: 0.2
  2460.  
  2461. phases:
  2462.  install:
  2463.    commands:
  2464.      - echo Entered the install phase...
  2465.      - apt-get -qq update &amp;amp;&amp;amp; apt-get -qq install curl
  2466.      - apt-get -qq install asciidoctor
  2467.      - curl -s -L https://github.com/gohugoio/hugo/releases/download/v0.53/hugo_0.53_Linux-64bit.deb -o hugo.deb
  2468.      - dpkg -i hugo.deb
  2469.    finally:
  2470.      - echo Installation done
  2471.  build:
  2472.    commands:
  2473.      - echo Entered the build phase ...
  2474.      - echo Build started on `date`
  2475.      - cd $CODEBUILD_SRC_DIR
  2476.      - rm -f buildspec.yml &amp;amp;&amp;amp; rm -f .git &amp;amp;&amp;amp; rm -f README.md
  2477.      - hugo --quiet
  2478.    finally:
  2479.      - echo Building the HTML files finished
  2480. artifacts:
  2481.  files:
  2482.    - &amp;#39;**/*&amp;#39;
  2483.  base-directory: $CODEBUILD_SRC_DIR/public/
  2484.  discard-paths: no&lt;/code&gt;&lt;/pre&gt;
  2485. &lt;/div&gt;
  2486. &lt;/div&gt;
  2487. &lt;div class=&#34;dlist&#34;&gt;
  2488. &lt;dl&gt;
  2489. &lt;dt class=&#34;hdlist1&#34;&gt;&lt;strong&gt;install:&lt;/strong&gt;&lt;/dt&gt;
  2490. &lt;dd&gt;
  2491. &lt;p&gt;Here we have all commands to install Hugo and asciidoctor&lt;/p&gt;
  2492. &lt;/dd&gt;
  2493. &lt;dt class=&#34;hdlist1&#34;&gt;&lt;strong&gt;build:&lt;/strong&gt;&lt;/dt&gt;
  2494. &lt;dd&gt;
  2495. &lt;p&gt;Here we switch to the directory with the source files from GitHub ($CODEBUILD_SRC_DIR) &amp;amp; execute the Hugo build command which will create all static pages in the directory &lt;strong&gt;public&lt;/strong&gt;&lt;/p&gt;
  2496. &lt;/dd&gt;
  2497. &lt;dt class=&#34;hdlist1&#34;&gt;&lt;strong&gt;artifacts:&lt;/strong&gt;&lt;/dt&gt;
  2498. &lt;dd&gt;
  2499. &lt;p&gt;here we define $CODEBUILD_SRC_DIR/public/ as base directory and add all files in this directory to the output artifact&lt;/p&gt;
  2500. &lt;/dd&gt;
  2501. &lt;/dl&gt;
  2502. &lt;/div&gt;
  2503. &lt;div class=&#34;paragraph&#34;&gt;
  2504. &lt;p&gt;We also have to define a Policy which should be used by the CodeBuild Project. In this example we only need access to the Input (kbil-artifacts) and Output (kbild-yourwebsite) S3 bucket and the CloudWatch logs. Following policy is used:&lt;/p&gt;
  2505. &lt;/div&gt;
  2506. &lt;div class=&#34;listingblock&#34;&gt;
  2507. &lt;div class=&#34;title&#34;&gt;CodeBuild Policy&lt;/div&gt;
  2508. &lt;div class=&#34;content&#34;&gt;
  2509. &lt;pre class=&#34;highlight&#34;&gt;&lt;code class=&#34;language-json&#34; data-lang=&#34;json&#34;&gt;---
  2510. {
  2511.    &amp;#34;Version&amp;#34;: &amp;#34;2012-10-17&amp;#34;,
  2512.    &amp;#34;Statement&amp;#34;: [
  2513.        {
  2514.            &amp;#34;Action&amp;#34;: &amp;#34;s3:*&amp;#34;,
  2515.            &amp;#34;Resource&amp;#34;: [
  2516.                &amp;#34;arn:aws:s3:::kbild-yourwebsite&amp;#34;,
  2517.                &amp;#34;arn:aws:s3:::kbild-yourwebsite/*&amp;#34;,
  2518.                &amp;#34;arn:aws:s3:::kbil-artifacts&amp;#34;,
  2519.                &amp;#34;arn:aws:s3:::kbil-artifacts/*&amp;#34;
  2520.            ],
  2521.            &amp;#34;Effect&amp;#34;: &amp;#34;Allow&amp;#34;,
  2522.            &amp;#34;Sid&amp;#34;: &amp;#34;VisualEditor0&amp;#34;
  2523.        },
  2524.        {
  2525.            &amp;#34;Action&amp;#34;: &amp;#34;logs:*&amp;#34;,
  2526.            &amp;#34;Resource&amp;#34;: &amp;#34;*&amp;#34;,
  2527.            &amp;#34;Effect&amp;#34;: &amp;#34;Allow&amp;#34;,
  2528.            &amp;#34;Sid&amp;#34;: &amp;#34;VisualEditor1&amp;#34;
  2529.        }
  2530.    ]
  2531. }
  2532. ---&lt;/code&gt;&lt;/pre&gt;
  2533. &lt;/div&gt;
  2534. &lt;/div&gt;
  2535. &lt;div class=&#34;paragraph&#34;&gt;
  2536. &lt;p&gt;This Build Project can now be added to the Code Pipeline as Build Stage.&lt;br/&gt;
  2537. &lt;code&gt;SourceCode&lt;/code&gt; artifact from GitHub will be used as input and the &lt;strong&gt;public html files&lt;/strong&gt; will be exported as &lt;code&gt;PublicFiles&lt;/code&gt; artifact which will be send to S3 later on.&lt;/p&gt;
  2538. &lt;/div&gt;
  2539. &lt;div class=&#34;imageblock&#34;&gt;
  2540. &lt;div class=&#34;content&#34;&gt;
  2541. &lt;img src=&#34;https://kbild.ch/201902/BuildAction.png&#34; alt=&#34;Build Action&#34;/&gt;
  2542. &lt;/div&gt;
  2543. &lt;/div&gt;
  2544. &lt;div class=&#34;paragraph&#34;&gt;
  2545. &lt;p&gt;After pushing a new blog post to the GitHub Repo we will see our CodePipeline in full action:&lt;br/&gt;&lt;/p&gt;
  2546. &lt;/div&gt;
  2547. &lt;div class=&#34;imageblock&#34;&gt;
  2548. &lt;div class=&#34;content&#34;&gt;
  2549. &lt;img src=&#34;https://kbild.ch/201902/Buildpipeline.png&#34; alt=&#34;Build Pipeline&#34;/&gt;
  2550. &lt;/div&gt;
  2551. &lt;/div&gt;
  2552. &lt;div class=&#34;paragraph&#34;&gt;
  2553. &lt;p&gt;Nice!&lt;/p&gt;
  2554. &lt;/div&gt;
  2555. &lt;div class=&#34;paragraph&#34;&gt;
  2556. &lt;p&gt;Adding additional stages and steps is pretty easy and I guess I will use CodePipelines a lot in future.&lt;/p&gt;
  2557. &lt;/div&gt;
  2558. &lt;div class=&#34;paragraph&#34;&gt;
  2559. &lt;p&gt;Stay tuned for a CloudFormation script which will create the whole pipeline.&lt;br/&gt;&lt;/p&gt;
  2560. &lt;/div&gt;
  2561. </description>
  2562.    </item>
  2563.    
  2564.    <item>
  2565.      <title>Back after a looong Time, Hello World!</title>
  2566.      <link>https://kbild.ch/blog/2019-01-26-backblogging/</link>
  2567.      <pubDate>Sat, 26 Jan 2019 15:06:10 +0000</pubDate>
  2568.      
  2569.      <guid>https://kbild.ch/blog/2019-01-26-backblogging/</guid>
  2570. <description>&lt;div class=&#34;paragraph&#34;&gt;
  2571. &lt;p&gt;It was quiet on this blog for a very long time.
  2572. I was pretty busy in private and business life and lost my blogging/social media mojo completely.&lt;/p&gt;
  2573. &lt;/div&gt;
  2574. &lt;div class=&#34;paragraph&#34;&gt;
  2575. &lt;p&gt;Doing a lot of new stuff recently and changing my &lt;a href=&#34;https://kbild.ch/about/&#34;&gt;job role&lt;/a&gt; I decided to start this blog over again but with some changes:&lt;/p&gt;
  2576. &lt;/div&gt;
  2577. &lt;div class=&#34;sect1&#34;&gt;
  2578. &lt;h2 id=&#34;_new_topics&#34;&gt;New Topics&lt;/h2&gt;
  2579. &lt;div class=&#34;sectionbody&#34;&gt;
  2580. &lt;div class=&#34;ulist&#34;&gt;
  2581. &lt;ul&gt;
  2582. &lt;li&gt;
  2583. &lt;p&gt;Hybrid Cloud Infrastructures&lt;/p&gt;
  2584. &lt;/li&gt;
  2585. &lt;li&gt;
  2586. &lt;p&gt;AWS, especially System Engineer stuff&lt;/p&gt;
  2587. &lt;/li&gt;
  2588. &lt;li&gt;
  2589. &lt;p&gt;MS Azure and how to combine it with other Cloud Services&lt;/p&gt;
  2590. &lt;/li&gt;
  2591. &lt;li&gt;
  2592. &lt;p&gt;IoT@Home, insights into stuff I do in my free time&lt;/p&gt;
  2593. &lt;/li&gt;
  2594. &lt;li&gt;
  2595. &lt;p&gt;Stuff that works for me&lt;/p&gt;
  2596. &lt;/li&gt;
  2597. &lt;/ul&gt;
  2598. &lt;/div&gt;
  2599. &lt;/div&gt;
  2600. &lt;/div&gt;
  2601. &lt;div class=&#34;sect1&#34;&gt;
  2602. &lt;h2 id=&#34;_new_blog_design_framework_thx_stoeps_for_the_idea&#34;&gt;New Blog Design &amp;amp; Framework (thx  &lt;a href=&#34;https://stoeps.de/2018/07/14/2018-07-14-new-blog-engine/&#34; target=&#34;_blank&#34; rel=&#34;noopener&#34;&gt;Stoeps&lt;/a&gt; for the idea)&lt;/h2&gt;
  2603. &lt;div class=&#34;sectionbody&#34;&gt;
  2604. &lt;div class=&#34;ulist&#34;&gt;
  2605. &lt;ul&gt;
  2606. &lt;li&gt;
  2607. &lt;p&gt;Hugo and AsciiDoc&lt;/p&gt;
  2608. &lt;/li&gt;
  2609. &lt;li&gt;
  2610. &lt;p&gt;AWS S3 and Cloudfront&lt;/p&gt;
  2611. &lt;/li&gt;
  2612. &lt;li&gt;
  2613. &lt;p&gt;Build pipeline&lt;/p&gt;
  2614. &lt;/li&gt;
  2615. &lt;/ul&gt;
  2616. &lt;/div&gt;
  2617. &lt;div class=&#34;paragraph&#34;&gt;
  2618. &lt;p&gt;Hoping to get my old readers back and finding some new readers in the future.
  2619. Comments always welcome (Blog, Twitter, Email)&lt;/p&gt;
  2620. &lt;/div&gt;
  2621. &lt;div class=&#34;paragraph&#34;&gt;
  2622. &lt;p&gt;Good to be back!&lt;/p&gt;
  2623. &lt;/div&gt;
  2624. &lt;/div&gt;
  2625. &lt;/div&gt;
  2626. </description>
  2627.    </item>
  2628.    
  2629.  </channel>
  2630. </rss>

Home · About · News · Docs · Terms

 
Copyright © 2002-9 Sam Ruby, Mark Pilgrim, Joseph Walton, and Phil Ringnalda