cf.json

{
  "AWSTemplateFormatVersion": "2010-09-09",

  "Description": "CloudFormation stack for Sheep C/D",

  "Parameters": {},

  "Resources": {
    "SNSTopic": {
      "Type": "AWS::SNS::Topic",
      "Properties": {
        "DisplayName": {
          "Fn::Join": [
            "-", [ "sheepcd", "sns", { "Ref": "AWS::StackName" } ]
          ]
        }
      }
    },

    "GithubSNSTopic": {
      "Type": "AWS::SNS::Topic",
      "Properties": {
        "DisplayName": {
          "Fn::Join": [
            "-", [ "sheepcd", "sns", "github", { "Ref": "AWS::StackName" } ]
          ]
        }
      }
    },

    "S3Bucket": {
      "Type" : "AWS::S3::Bucket",
      "Properties" : {
        "BucketName": {
          "Fn::Join": [
            "-", [ "sheepcd", "s3root", { "Ref": "AWS::StackName" } ]
          ]
        },
        "WebsiteConfiguration": {
          "IndexDocument": "index.html"
        }
      },
      "DeletionPolicy": "Retain"
    },
    "S3BucketPolicy": {
      "Type" : "AWS::S3::BucketPolicy",
      "Properties" : {
        "Bucket": { "Ref": "S3Bucket" },
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": "*",
              "Action": "s3:GetObject",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:aws:s3:::sheepcd-s3root-",
                      { "Ref": "AWS::StackName" },
                      "/templates/*"
                    ]
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:aws:s3:::sheepcd-s3root-",
                      { "Ref": "AWS::StackName" },
                      "/index.html"
                    ]
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:aws:s3:::sheepcd-s3root-",
                      { "Ref": "AWS::StackName" },
                      "/style.css"
                    ]
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:aws:s3:::sheepcd-s3root-",
                      { "Ref": "AWS::StackName" },
                      "/utils.js"
                    ]
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:aws:s3:::sheepcd-s3root-",
                      { "Ref": "AWS::StackName" },
                      "/favicon.png"
                    ]
                  ]
                }
              ]
            }
          ]
        }
      }
    },

    "ConfigTable": {
      "Type": "AWS::DynamoDB::Table",
      "Properties": {
        "TableName": {
          "Fn::Join": [
            "-", [ "sheepcd", "ddb", { "Ref": "AWS::StackName" } ]
          ]
        },
        "KeySchema": [
          {
            "AttributeName": "pipeline",
            "KeyType": "HASH"
          },
          {
            "AttributeName": "config",
            "KeyType": "RANGE"
          }
        ],
        "ProvisionedThroughput": {
          "ReadCapacityUnits": 1,
          "WriteCapacityUnits": 1
        },
        "AttributeDefinitions": [
          {
            "AttributeName": "pipeline",
            "AttributeType": "S"
          },
          {
            "AttributeName": "config",
            "AttributeType": "S"
          }
        ]
      }
    },

    "ExecutorRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version" : "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [ "lambda.amazonaws.com" ]
              },
              "Action": [ "sts:AssumeRole" ]
            }
          ]
        },
        "Path": "/",
        "Policies": [
          {
            "PolicyName": "access",
            "PolicyDocument": {
              "Version" : "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "lambda:InvokeFunction"
                  ],
                  "Resource": "*"
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "sns:Publish",
                    "sns:Subscribe",
                    "sns:Unsubscribe"
                  ],
                  "Resource": { "Ref": "SNSTopic" }
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "sns:Publish",
                    "sns:Subscribe",
                    "sns:Unsubscribe"
                  ],
                  "Resource": { "Ref": "GithubSNSTopic" }
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "s3:GetBucketLocation",
                    "s3:ListAllMyBuckets"
                  ],
                  "Resource": "arn:aws:s3:::*"
                },
                {
                  "Effect": "Allow",
                  "Action": [ "s3:ListBucket" ],
                  "Resource": {
                    "Fn::Join": [
                      "",
                      [
                        "arn:aws:s3:::sheepcd-s3root-",
                        { "Ref": "AWS::StackName" }
                      ]
                    ]
                  }
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "s3:*"
                  ],
                  "Resource": {
                    "Fn::Join": [
                      "",
                      [
                        "arn:aws:s3:::sheepcd-s3root-",
                        { "Ref": "AWS::StackName" },
                        "/*"
                      ]
                    ]
                  }
                },
                {
                  "Effect": "Allow",
                  "Action": [
                      "logs:CreateLogGroup",
                      "logs:CreateLogStream",
                      "logs:PutLogEvents"
                  ],
                  "Resource": {
                    "Fn::Join": [
                      "",
                      [
                        "arn:aws:logs:",
                        { "Ref": "AWS::Region" },
                        ":*:*"
                      ]
                    ]
                  }
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "dynamodb:GetItem",
                    "dynamodb:BatchGetItem",
                    "dynamodb:Query",
                    "dynamodb:PutItem",
                    "dynamodb:UpdateItem",
                    "dynamodb:DeleteItem",
                    "dynamodb:BatchWriteItem"
                  ],
                  "Resource": {
                    "Fn::Join": [
                      "", [
                        "arn:aws:dynamodb:",
                        { "Ref": "AWS::Region" },
                        ":*:table/",
                        {
                          "Fn::Join": [
                            "-", [
                              "sheepcd", "ddb", { "Ref": "AWS::StackName" }
                            ]
                          ]
                        }
                      ]
                    ]
                  }
                }
              ]
            }
          }
        ]
      }
    }
  },

  "Outputs": {
    "LambdaExecutorRole": {
      "Value": {
        "Fn::Join": [
          "",
          [
            "arn:aws:iam::",
            { "Ref": "AWS::AccountId" },
            ":role/",
            { "Ref": "ExecutorRole" }
          ]
        ]
      }
    }
  }

}