ec2-jenkins-service.yaml

# aws cloudformation create-stack --capabilities CAPABILITY_NAMED_IAM --stack-name jenkins-service-us-east-1-demo --template-body file://ec2-jenkins-service.yaml --parameters file://params/jenkins-service-params-us-east-1-demo.json

AWSTemplateFormatVersion: '2010-09-09'

Description: >
  This template creates a Jenkins EC2 instance.

Parameters:
  DeploymentId:
    Type: String
    Description: A unique deployment identifier.

  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: EC2 KeyPair to enable SSH access to the ECS instances.

  InstanceType:
    Description: EC2 instance type
    Type: String
    Default: t2.micro
    AllowedValues: [t2.micro, t2.small, t2.medium, t2.large]
    ConstraintDescription: Please choose a valid instance type.

  Service:
    Type: String
    Description: Name of the service or product that is associated with this stack.

  Owner:
    Type: String
    Description: Email address of the person that created the stack.

  AmiId:
    Type: String
    Description: Amazon Machine Image ID

  HostedZoneName:
    Type: String
    Description: Route53 DNS Hosted Zone Name.
    
  HostedZoneInternalName:
    Type: String
    Description: Route53 DNS Hosted Zone Name.

Resources:
### EC2 ###
  JenkinsEc2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref 'AmiId'
      InstanceType: !Ref 'InstanceType'
      SubnetId: !ImportValue 'PublicSubnetAz1'
      KeyName: !Ref 'KeyName'
      SecurityGroupIds: [!Ref 'JenkinsEc2SecurityGroup']
      IamInstanceProfile: !Ref 'JenkinsInstanceProfile'
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeSize: '50'
            VolumeType: 'gp2'
      Tags:
        - Key: Name
          Value: !Sub ${Service}-${DeploymentId}
        - Key: Service
          Value: !Ref 'Service'
        - Key: Owner
          Value: !Ref 'Owner'
      UserData:
        Fn::Base64:
          !Sub |
            #!/bin/bash -xe
            # Install AWS Tools
            wget https://aws-codedeploy-${AWS::Region}.s3.amazonaws.com/latest/install
            chmod +x ./install
            yum -y install ruby
            ./install auto
            yum install -y aws-cfn-bootstrap
            # Install Salt Minion and set system role
            yum install -y https://repo.saltstack.com/yum/amazon/salt-amzn2-repo-latest.amzn2.noarch.rpm
            yum clean expire-cache
            yum install -y salt-minion
            systemctl enable salt-minion.service
            echo 'role: jenkins' >> /etc/salt/grains
            systemctl start salt-minion.service
            # Install Jenkins and supporting software
            #wget http://mirrors.gigenet.com/apache/maven/maven-3/3.5.2/binaries/apache-maven-3.5.2-bin.tar.gz
            #tar -xf apache-maven-3.5.2-bin.tar.gz -C /opt
            wget -O /etc/yum.repos.d/jenkins.repo https://pkg.jenkins.io/redhat/jenkins.repo
            rpm --import https://pkg.jenkins.io/redhat/jenkins.io.key
            yum install -y java-1.8.0-openjdk jenkins jq git
            amazon-linux-extras install docker
            systemctl enable docker
            systemctl start docker
            systemctl enable jenkins
            systemctl start jenkins
            usermod -a -G docker ec2-user
            usermod -a -G docker jenkins
            usermod -s /bin/bash jenkins
            # Send CloudFormation Signals
            /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource JenkinsEc2Instance --region ${AWS::Region}
            /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource JenkinsEc2Instance --region ${AWS::Region}

### S3 ###
  JenkinsS3Bucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    Properties:
      BucketName: !Join ['', [ capstone, -, !Ref 'Service', -, !Ref 'AWS::Region']]
      VersioningConfiguration:
        Status: Enabled

### Route 53 ###
   JenkinsDnsRecord:
     Type: AWS::Route53::RecordSet
     Properties:
       HostedZoneName: !Ref 'HostedZoneName'
       Comment: DNS name for Jenkins instance.
       Name: !Join ['', [!Ref 'Service', ., !Ref 'HostedZoneName']]
       Type: CNAME
       TTL: '300'
       ResourceRecords:
       - !GetAtt JenkinsPublicAlb.DNSName

   JenkinsInternalDnsRecord:
     Type: AWS::Route53::RecordSet
     DependsOn: JenkinsEc2Instance
     Properties:
       HostedZoneName: !Ref 'HostedZoneInternalName'
       Comment: DNS name for Jenkins instance.
       Name: !Join ['', [!Ref 'Service', ., !Ref 'AWS::Region', ., !Ref 'DeploymentId', ., !Ref 'HostedZoneInternalName']]
       Type: CNAME
       TTL: '300'
       ResourceRecords:
       - !GetAtt JenkinsEc2Instance.PrivateDnsName

### Security Groups ###
  JenkinsEc2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Jenkins Security Group
      VpcId: !ImportValue 'VpcId'
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '443'
        ToPort: '443'
        CidrIp: 192.30.252.0/22 # Github
      - IpProtocol: tcp
        FromPort: '443'
        ToPort: '443'
        CidrIp: 185.199.108.0/22 # Github
      - IpProtocol: tcp
        FromPort: '443'
        ToPort: '443'
        CidrIp: 140.82.112.0/20 # Github
      Tags:
        - Key: Service
          Value: Jenkins
        - Key: Name
          Value: jenkins-ec2-sg

# Allow Web port 8080 access to Jenkins EC2 instance from VPC addresses
  JenkinsEc2SecurityGroup8080inbound:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref 'JenkinsEc2SecurityGroup'
      IpProtocol: tcp
      FromPort: '8080'
      ToPort: '8080'
      CidrIp: 10.19.0.0/24

# Allow SSH port 22 access to Jenkins EC2 instance from VPC addresses
  JenkinsEc2SecurityGroupSshInbound:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref 'JenkinsEc2SecurityGroup'
      IpProtocol: tcp
      FromPort: '22'
      ToPort: '22'
      CidrIp: 10.19.0.0/24

### IAM Role & Policies ###
  JenkinsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
                - codedeploy.amazonaws.com
            Action:
                - sts:AssumeRole
      Path: /

# Allow Jenkins service access to S3
  JenkinsS3AccessPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: JenkinsS3AccessPolicy
      Roles:
        - !Ref 'JenkinsRole'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - s3:*
            Resource: !Sub 'arn:aws:s3:::${JenkinsS3Bucket}'

# Allow Jenkins service access to CloudFormation
  JenkinsCloudFormationPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: JenkinsCloudFormationPolicy
      Roles:
        - !Ref 'JenkinsRole'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - cloudformation:ValidateTemplate
            Resource:
              - '*'
          - Effect: Allow
            Action:
              - cloudformation:*
            Resource:
              - !Sub 'arn:aws:cloudformation:*:${AWS::AccountId}:stack/*'

# Allow Jenkins service access to CodeDeploy
  JenkinsCodeDeployPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: JenkinsCodeDeployPolicy
      Roles:
        - !Ref 'JenkinsRole'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - codedeploy:BatchGet*
              - codedeploy:*DeploymentConfig*
              - codedeploy:Get*
              - codedeploy:List*
            Resource:
              - arn:aws:codedeploy:*:*:application:*
              - arn:aws:codedeploy:*:*:deploymentconfig:*
              - arn:aws:codedeploy:*:*:deploymentgroup:*

# Allow Jenkins service access to SNS
  JenkinsSnsPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: JenkinsSnsPolicy
      Roles:
        - !Ref 'JenkinsRole'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - sns:*
            Resource:
              - !Sub 'arn:aws:sns:*:${AWS::AccountId}:*'

# Allow Jenkins service access to EC2
  JenkinsEc2Policy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: JenkinsEc2Policy
      Roles:
        - !Ref 'JenkinsRole'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - ec2:DescribeImages
              - ec2:GetPasswordData
              - ec2:CreateImage
            Resource:
              - '*'

# Allow Jenkins service access to SSM
  JenkinsSsmPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: JenkinsSsmPolicy
      Roles:
        - !Ref 'JenkinsRole'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - ssm:*
              - ec2messages:AcknowledgeMessage
              - ec2messages:DeleteMessage
              - ec2messages:FailMessage
              - ec2messages:GetEndpoint
              - ec2messages:GetMessages
              - ec2messages:SendReply
            Resource:
              - '*'

# Allow Jenkins service access to IAM
  JenkinsIamPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: JenkinsIamPolicy
      Roles:
        - !Ref 'JenkinsRole'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - iam:CreateRole
              - iam:CreatePolicy
              - iam:PutRolePolicy
              - iam:CreateInstanceProfile
              - iam:AttachRolePolicy
              - iam:List*
              - iam:Get*
              - iam:PassRole
            Resource:
              - '*'
          - Effect: Allow
            Action:
              - iam:DeleteRole
              - iam:DeleteRolePolicy
              - iam:DeletePolicy
              - iam:DetachRolePolicy
            Resource:
              - !Sub 'arn:aws:iam::${AWS::AccountId}:role/codedeploy-setupcodedeploy-i-CodeDeployServiceRole-*'
              - !Sub 'arn:aws:iam::${AWS::AccountId}:policy/codedeploy-setupcodedeploy-iam-infrastructure-CodeDeployManagedPolicy-*'
              - !Sub 'arn:aws:iam::${AWS::AccountId}:policy/credentials-setupcredentials-config-S3CredentialsManagedPolicy-*'
          - Effect: Allow
            Action:
              - kms:*
            Resource:
              - '*'

# Allow Jenkins service access to Lambda
  JenkinsLambdaPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: JenkinsLambdaPolicy
      Roles:
        - !Ref 'JenkinsRole'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - lambda:*
              - logs:*
              - events:*
            Resource:
              - '*'

# Allow Jenkins service access to ECS
  JenkinsEcsAccess:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: JenkinsEcsAccess
      Roles:
        - !Ref 'JenkinsRole'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - ecr:*
              - ecs:*
            Resource:
              - '*'

# Allow Jenkins service access to Assume IAM roles
  JenkinsAssumeRolePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: JenkinsAssumeRolePolicy
      Roles:
        - !Ref 'JenkinsRole'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Resource:
              - '*'

# Allow Jenkins service access to CloudWatch
  JenkinsCloudWatchPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: JenkinsCloudWatchPolicy
      Roles:
        - !Ref 'JenkinsRole'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - cloudwatch:ListMetrics
              - cloudwatch:GetMetricStatistics
              - cloudwatch:PutMetricData
            Resource: '*'

# Jenkins EC2 Instance profile for which the Jenkins IAM role is associated
  JenkinsInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref 'JenkinsRole'

Outputs:
  JenkinsEc2InstancePrivateDnsName:
    Value: !GetAtt JenkinsEc2Instance.PrivateDnsName