|
| 1 | +// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. |
| 2 | +// SPDX-License-Identifier: Apache-2.0 |
| 3 | + |
| 4 | +import * as cdk from "aws-cdk-lib"; |
| 5 | +import * as lambda from "aws-cdk-lib/aws-lambda"; |
| 6 | +import * as iam from "aws-cdk-lib/aws-iam"; |
| 7 | +import * as events from "aws-cdk-lib/aws-events"; |
| 8 | +import * as targets from "aws-cdk-lib/aws-events-targets"; |
| 9 | +import { Construct } from "constructs"; |
| 10 | +import * as path from "path"; |
| 11 | + |
| 12 | +const repoName = "AWSDocsSdkExamplesPublic"; |
| 13 | +const awsRegion = "us-west-2"; |
| 14 | + |
| 15 | +class CodeCommitCloneStack extends cdk.Stack { |
| 16 | + constructor(scope: Construct, id: string, props?: cdk.StackProps) { |
| 17 | + super(scope, id, props); |
| 18 | + |
| 19 | + // Initialize Lambda function |
| 20 | + const cloneLambda = this.initCloneLambda(); |
| 21 | + |
| 22 | + // Set up EventBridge rule to trigger Lambda on CodeCommit repository changes |
| 23 | + this.initCodeCommitTrigger(cloneLambda); |
| 24 | + } |
| 25 | + |
| 26 | + private initCloneLambda(): lambda.Function { |
| 27 | + // IAM Role and Policy for Lambda to access CodeCommit |
| 28 | + const lambdaExecutionRole = new iam.Role(this, "CloneLambdaExecutionRole", { |
| 29 | + assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"), |
| 30 | + description: "Execution role for Lambda function to clone CodeCommit repo", |
| 31 | + managedPolicies: [ |
| 32 | + iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole"), |
| 33 | + ], |
| 34 | + }); |
| 35 | + |
| 36 | + // Grant necessary permissions to CodeCommit and S3 |
| 37 | + lambdaExecutionRole.addToPolicy( |
| 38 | + new iam.PolicyStatement({ |
| 39 | + actions: [ |
| 40 | + "codecommit:GetRepository", |
| 41 | + "codecommit:GitPull", |
| 42 | + "codecommit:GetBranch", |
| 43 | + "codecommit:GetDifferences", |
| 44 | + "codecommit:GetFile" |
| 45 | + ], |
| 46 | + resources: [`arn:aws:codecommit:${awsRegion}:${this.account}:${repoName}`], |
| 47 | + }) |
| 48 | + ); |
| 49 | + |
| 50 | + // Grant necessary permissions to S3 bucket "codeexamplestats" for Get and Put |
| 51 | + lambdaExecutionRole.addToPolicy( |
| 52 | + new iam.PolicyStatement({ |
| 53 | + actions: ["s3:GetObject", "s3:PutObject"], |
| 54 | + resources: [`arn:aws:s3:::codeexamplestats/*`], // Allow access to all objects in the bucket |
| 55 | + }) |
| 56 | + ); |
| 57 | + |
| 58 | + // Define the Lambda function, pointing directly to the source code directory |
| 59 | + const cloneLambda = new lambda.Function(this, "CodeCommitCloneLambda", { |
| 60 | + runtime: lambda.Runtime.PYTHON_3_9, |
| 61 | + handler: "index.lambda_handler", |
| 62 | + code: lambda.Code.fromAsset(path.join(__dirname, "lambda")), // Pointing to the directory of the lambda function code |
| 63 | + environment: { |
| 64 | + REPO_NAME: repoName, |
| 65 | + }, |
| 66 | + timeout: cdk.Duration.minutes(5), |
| 67 | + role: lambdaExecutionRole, |
| 68 | + }); |
| 69 | + |
| 70 | + return cloneLambda; |
| 71 | + } |
| 72 | + |
| 73 | + private initCodeCommitTrigger(cloneLambda: lambda.Function): void { |
| 74 | + // Create EventBridge rule for CodeCommit repository updates |
| 75 | + const codeCommitRule = new events.Rule(this, "CodeCommitUpdateRule", { |
| 76 | + eventPattern: { |
| 77 | + source: ["aws.codecommit"], |
| 78 | + detailType: ["CodeCommit Repository State Change"], |
| 79 | + resources: [`arn:aws:codecommit:${awsRegion}:${this.account}:${repoName}`], |
| 80 | + detail: { |
| 81 | + event: [ |
| 82 | + "referenceCreated", |
| 83 | + "referenceUpdated", |
| 84 | + "referenceDeleted" |
| 85 | + ] |
| 86 | + } |
| 87 | + } |
| 88 | + }); |
| 89 | + |
| 90 | + // Add Lambda function as the target of the EventBridge rule |
| 91 | + codeCommitRule.addTarget(new targets.LambdaFunction(cloneLambda)); |
| 92 | + } |
| 93 | +} |
| 94 | + |
| 95 | +const app = new cdk.App(); |
| 96 | +new CodeCommitCloneStack(app, "CodeCommitCloneStack", { |
| 97 | + env: { |
| 98 | + account: process.env.CDK_DEFAULT_ACCOUNT, |
| 99 | + region: "us-west-2", // Where codecommit is stored |
| 100 | + }, |
| 101 | +}); |
| 102 | +app.synth(); |
0 commit comments