web-ui-pipeline.yaml

AWSTemplateFormatVersion: 2010-09-09

Description: >
    This template deploys the Retail Demo Store Web UI deployment pipeline.

Parameters:
  ResourceBucket:
    Type: String
    Description: S3Bucket Bucket where the deployment Resources are stored (cloudformation, images, lambda code)

  ResourceBucketRelativePath:
    Type: String
    Description: S3Bucket Path where the deployment Resources are stored (cloudformation, images, lambda code) (i.e. path/path2), can be empty if resources are at the root of the bucket. MUST contain trailing /

  WebUICDN:
    Type: String
    Description: CloudFront distribution ID for the Web UI CDN

  WebUIBucketName:
    Type: String
    Description: S3 bucket where Web UI assets stored for serving via CloudFront

  WebRootUrl:
    Type: String
    Description: Public facing root URL where the Retail Demo Store web user interface is served. Used when building fully qualified URLs for the web user interface.
    AllowedPattern: "^https?://[^\\s/$.?#].[^\\s]*$"
    ConstraintDescription: Must be a valid URL referring to the root domain where web assets are located

  ImageRootUrl:
    Type: String
    Description: URL where Retail Demo Store images such as product images are located
    AllowedPattern: "^https?://[^\\s/$.?#].[^\\s]*$"
    ConstraintDescription: Must be a valid URL referring to the root path where images are located

  SourceDeploymentType:
    Type: String
    Description: Retail Demo Store source deployment type
    AllowedValues:
      - 'GitHub'
      - 'S3'
    Default: 'S3'

  GitHubRepo:
    Type: String

  GitHubBranch:
    Type: String
    Default: master

  GitHubToken:
    Type: String
    NoEcho: true

  GitHubUser:
    Type: String

  AmazonPayPublicKeyId:
    Type: String
    Description: Public Key ID for the Amazon Pay sandbox account being used

  AmazonPayStoreId:
    Type: String
    Description: Store ID of the Amazon Pay sandbox account being used

  AmazonPayMerchantId:
    Type: String
    Description: Merchant ID of the Amazon Pay sandbox account being used

  UserPoolId:
    Type: String

  UserPoolClientId:
    Type: String

  IdentityPoolId:
    Type: String

  APIGatewayUrl:
    Type: String
    Default: none

  PinpointAppId:
    Type: String
    Default: none

  ParameterPersonalizeEventTrackerId:
    Type: String

  ParameterAmplitudeApiKey:
    Type: String
    Description: SSM parameter name for the Amplitude API key parameter name

  ParameterOptimizelySdkKey:
    Type: String
    Description: SSM Parameter name for the Optimizely SDK key parameter name

  ParameterSegmentWriteKey:
    Type: String
    Description: SSM Parameter name for the Segment write key parameter name

  ParameterGoogleAnalyticsMeasurementId:
    Type: String
    Description: Google Analytics Measurement Id parameter name

  CleanupBucketLambdaArn:
    Type: String
    Description: Lambda Arn for cleanup function

  LocationResourceName:
    Type: String
    Description: Name of Location resources (Map, Geofence collection, Tracker)

  LocationNotificationEndpoint:
    Type: String
    Description: URL of WebSocket API for Geofence notifications

  FenixZipDetectUrl:
    Type: String
    Description: Fenix Commerce Zipcode Detect URL
    Default: 'https://ipapi.co/json?key=cKGC3jQbSIoXYmI2KtXObugsKfosD9Yr0HnkHhPUu1SM2wQhE0'

  FenixTenantId:
    Type: String
    Description: Fenix Commerce Demo Env TenantID
    Default: 'ec6ea3439489426ba09cf6c906ead8d5'

  FenixEddEndpoint:
    Type: String
    Description: Fenix Commerce Estimated Delivery Date Endpoint URL
    Default: 'https://awsretaildemo.delest.fenixcommerce.com/fenixdelest/api/v2/deliveryestimates'

  FenixMonetaryValue:
    Type: String
    Description: Fenix Commerce Default monetary value to control free shipping above $100 default for demo
    Default: '100'

  FenixEnabledPdp:
    Type: String
    Description: Fenix Commerce Flag to enable EDD on PDP
    Default: 'TRUE'

  FenixEnabledCart:
    Type: String
    Description: Fenix Commerce Flag to enable EDD on CART
    Default: 'TRUE'

  FenixEnabledCheckout:
    Type: String
    Description: Fenix Commerce Flag to enable EDD on checkout
    Default: 'TRUE'

  FenixXapiKey:
    Type: String
    Description: Fenix Commerce Demo Env x-api-key
    Default: 'nr50Qdu7FM94n2X1GYuhA8cFzyvdYTJ5Qka4XMOd'

  LoggingBucketName:
    Type: String
    Description: S3 Bucket For logging

  BedrockProductPersonalization:
    Type: String
    Description: Flag to enable product personalization in web-ui feature driven by Bedrock. Amazon Bedrock users need to request access to models before they are available for use. To demo Personalised Product Descriptions make sure to enable access to Anthropic's Claude v2 via the Amazon Bedrock Management Console. Check README Notes for more details.
    Default: 'No'

  RoomImagesBucket:
    Type: String
    Description: S3 Bucket name to contain room images for room makeover demo

Conditions:
  LinkToGitHub: !Equals [ !Ref SourceDeploymentType, 'GitHub' ]
  LinkToS3: !Equals [ !Ref SourceDeploymentType, 'S3' ]

Resources:

  CodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: "logs"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - ssm:GetParameters
                  - cloudfront:CreateInvalidation
                Resource: "*"
        - PolicyName: "S3"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::${ArtifactBucket}/*
                  - !Sub arn:${AWS::Partition}:s3:::${WebUIBucketName}/*

  CodePipelineServiceRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: codepipeline.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Resource:
                  - !Sub arn:${AWS::Partition}:s3:::${ArtifactBucket}/*
                  - !Sub arn:${AWS::Partition}:s3:::${ArtifactBucket}
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning
              - Resource: "*"
                Effect: Allow
                Action:
                  - codebuild:StartBuild
                  - codebuild:BatchGetBuilds
              - Resource:
                  - !Sub arn:${AWS::Partition}:s3:::${ResourceBucket}/*
                  - !Sub arn:${AWS::Partition}:s3:::${ResourceBucket}
                Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:GetObjectVersion
                  - s3:GetBucketVersioning

  ArtifactBucket:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        DestinationBucketName: !Ref LoggingBucketName
        LogFilePrefix: artifactui-logs
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
            BucketKeyEnabled: true

  # Empties bucket when stack is deleted
  EmptyArtifactBucket:
    Type: Custom::EmptyArtifactBucket
    Properties:
      ServiceToken: !Ref CleanupBucketLambdaArn
      BucketName: !Ref ArtifactBucket

  CodeBuildProject:
    Type: 'AWS::CodeBuild::Project'
    Properties:
      Name: !Ref AWS::StackName
      Description: !Sub 'Building stage for ${AWS::StackName}'
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: src/web-ui/buildspec.yml
      ServiceRole: !Ref CodeBuildServiceRole
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        EnvironmentVariables:
          - Name: WEB_BUCKET_NAME
            Value: !Ref WebUIBucketName
          - Name: CLOUDFRONT_DIST_ID
            Value: !Ref WebUICDN
          - Name: AMAZON_PAY_PUBLIC_KEY_ID
            Value: !Ref AmazonPayPublicKeyId
          - Name: AMAZON_PAY_STORE_ID
            Value: !Ref AmazonPayStoreId
          - Name: AMAZON_PAY_MERCHANT_ID
            Value: !Ref AmazonPayMerchantId
          - Name: COGNITO_USER_POOL_ID
            Value: !Sub ${UserPoolId}
          - Name: COGNITO_USER_POOL_CLIENT_ID
            Value: !Sub ${UserPoolClientId}
          - Name: COGNITO_IDENTITY_POOL_ID
            Value: !Sub ${IdentityPoolId}
          - Name: API_GATEWAY_URL
            Value: !Ref APIGatewayUrl
          - Name: DEPLOYED_REGION
            Value: !Ref AWS::Region
          - Name: PINPOINT_APP_ID
            Value: !Ref PinpointAppId
          - Name: PERSONALIZE_TRACKING_ID
            Type: PARAMETER_STORE
            Value: !Ref ParameterPersonalizeEventTrackerId
          - Name: AMPLITUDE_API_KEY
            Type: PARAMETER_STORE
            Value: !Ref ParameterAmplitudeApiKey
          - Name: OPTIMIZELY_SDK_KEY
            Type: PARAMETER_STORE
            Value: !Ref ParameterOptimizelySdkKey
          - Name: LOCATION_RESOURCE_NAME
            Value: !Ref LocationResourceName
          - Name: LOCATION_NOTIFICATION_URL
            Value: !Ref LocationNotificationEndpoint
          - Name: SEGMENT_WRITE_KEY
            Type: PARAMETER_STORE
            Value: !Ref ParameterSegmentWriteKey
          - Name: GOOGLE_ANALYTICS_ID
            Type: PARAMETER_STORE
            Value: !Ref ParameterGoogleAnalyticsMeasurementId
          - Name: WEB_ROOT_URL
            Value: !Ref WebRootUrl
          - Name: IMAGE_ROOT_URL
            Value: !Ref ImageRootUrl
          - Name: FENIX_ZIP_DETECT_URL
            Value: !Ref FenixZipDetectUrl
          - Name: FENIX_TENANT_ID
            Value: !Ref FenixTenantId
          - Name: FENIX_EDD_ENDPOINT
            Value: !Ref FenixEddEndpoint
          - Name: FENIX_MONETARY_VALUE
            Value: !Ref FenixMonetaryValue
          - Name: FENIX_ENABLED_PDP
            Value: !Ref FenixEnabledPdp
          - Name: FENIX_ENABLED_CART
            Value: !Ref FenixEnabledCart
          - Name: FENIX_ENABLED_CHECKOUT
            Value: !Ref FenixEnabledCheckout
          - Name: FENIX_X_API_KEY
            Value: !Ref FenixXapiKey
          - Name: BEDROCK_PRODUCT_PERSONALIZATION
            Value: !Ref BedrockProductPersonalization
          - Name: ROOM_IMAGES_BUCKET
            Value: !Ref RoomImagesBucket
        Image: 'aws/codebuild/amazonlinux2-x86_64-standard:5.0'
        Type: LINUX_CONTAINER

  PipelineGitHub:
    Condition: LinkToGitHub
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      Tags:
        -
          Key: RetailDemoStoreServiceName
          Value: web-ui
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactBucket
      Stages:
        - Name: Source
          Actions:
            - Name: App
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: '1'
                Provider: GitHub
              Configuration:
                Owner: !Ref GitHubUser
                Repo: !Ref GitHubRepo
                Branch: !Ref GitHubBranch
                OAuthToken: !Ref GitHubToken
              OutputArtifacts:
                - Name: App
              RunOrder: 1
        - Name: Build
          Actions:
            - Name: Build-and-Deploy
              InputArtifacts:
                - Name: App
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: '1'
                Provider: CodeBuild
              OutputArtifacts:
                - Name: BuildOutput
              Configuration:
                ProjectName: !Ref CodeBuildProject
              RunOrder: 1

  PipelineS3:
    Condition: LinkToS3
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      Tags:
        -
          Key: RetailDemoStoreServiceName
          Value: web-ui
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactBucket
      Stages:
        - Name: Source
          Actions:
            - Name: App
              ActionTypeId:
                Category: Source
                Owner: AWS
                Version: '1'
                Provider: S3
              Configuration:
                S3Bucket: !Ref ResourceBucket
                S3ObjectKey: !Sub '${ResourceBucketRelativePath}source/retaildemostore-source.zip'
                PollForSourceChanges: false
              OutputArtifacts:
                - Name: App
              RunOrder: 1
        - Name: Build
          Actions:
            - Name: Build-and-Deploy
              InputArtifacts:
                - Name: App
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: '1'
                Provider: CodeBuild
              OutputArtifacts:
                - Name: BuildOutput
              Configuration:
                ProjectName: !Ref CodeBuildProject
              RunOrder: 1

  EventRole:
    Condition: LinkToS3
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        -
          PolicyName: eb-pipeline-execution
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action: codepipeline:StartPipelineExecution
                Resource: !Join [ '', [ 'arn:aws:codepipeline:', !Ref 'AWS::Region', ':', !Ref 'AWS::AccountId', ':', !Ref PipelineS3 ] ]

  EventRule:
    Condition: LinkToS3
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        source:
          - aws.s3
        detail-type:
          - 'Object Created'
        detail:
          bucket:
            name:
              - !Ref ResourceBucket
          object:
            key:
              - !Sub ${ResourceBucketRelativePath}source/retaildemostore-source.zip
      Targets:
        - Arn: !Sub 'arn:${AWS::Partition}:codepipeline:${AWS::Region}:${AWS::AccountId}:${PipelineS3}'
          RoleArn: !GetAtt EventRole.Arn
          Id: codepipeline-AppPipeline

Outputs:
  PipelineForGitHubUrl:
    Condition: LinkToGitHub
    Value: !Sub https://console.aws.amazon.com/codepipeline/home?region=${AWS::Region}#/view/${PipelineGitHub}

  PipelineForS3Url:
    Condition: LinkToS3
    Value: !Sub https://console.aws.amazon.com/codepipeline/home?region=${AWS::Region}#/view/${PipelineS3}