PaulDuvall

    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: index-get.handler
      CodeUri: src/
      Runtime: nodejs12.x
      AutoPublishAlias: live
      DeploymentPreference: ...
      MemorySize: 128
      Policies:
        - DynamoDBReadPolicy:

PaulDuvall

version: 0.2
phases:
  install:
    runtime-versions:
      nodejs: 10
    commands:
      - node --version
      - npm install newman --global
      - yum install -y jq
  pre_build:

PaulDuvall

    {
      "name": "cloudproviders",
      "_postman_id": "ff104412-e27d-4aec-8876-8aceea5f9e45",
      "request": {
        "method": "GET",
        "header": [

        ],
        "url": "{{apigw-root}}"
      },

PaulDuvall

      - Name: BuildLambda
        Actions:
        - InputArtifacts:
          - Name: MyApp
          Name: BuildLambdaFunctions
          ActionTypeId:
            Category: Build
            Owner: AWS
            Version: '1'
            Provider: CodeBuild

PaulDuvall

version: 0.2
phases:
  install:
    runtime-versions:
      python: 3.7
    commands:
      - python --version
  build:
    commands:
      - pip install --user aws-sam-cli

PaulDuvall

  CodeCommitRepo:
    Type: AWS::CodeCommit::Repository
    Properties:
      RepositoryName:
        Ref: PipelineBucket
      RepositoryDescription: CodeCommit Repository for Secrets Rotation Solution
      Code:
        S3:
          Bucket: !Ref CodeCommitS3Bucket
          Key: !Ref CodeCommitS3Key

PaulDuvall

cd ~/environment
aws s3 mb s3://ceoa-3-$(aws sts get-caller-identity --output text --query 'Account')
git clone https://github.com/PaulDuvall/aws-encryption-workshop.git
cd aws-encryption-workshop/lesson3-develop

zip ceoa-3-examples.zip *.*
aws s3 sync /home/ec2-user/environment/aws-encryption-workshop/lesson3-develop s3://ceoa-3-$(aws sts get-caller-identity --output text --query 'Account')

aws cloudformation create-stack --stack-name rds-secrets-rotation --disable-rollback --template-body file:///home/ec2-user/environment/aws-encryption-workshop/lesson3-develop/ceoa-3-rotation-1-pipeline.yml --parameters ParameterKey=EmailAddress,ParameterValue=fake-email@fake-fake-fake-email.com ParameterKey=CodeCommitS3Bucket,ParameterValue=ceoa-3-$(aws sts get-caller-identity --output text --query 'Account') ParameterKey=CodeCommitS3Key,ParameterValue=ceoa-3-examples.zip --capabilities CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND --disable-rollback

PaulDuvall

  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      RoleArn: !GetAtt CodePipelineRole.Arn
      Stages:
      - Name: Source
        Actions:
        - InputArtifacts: []
          Name: Source
          ActionTypeId:

PaulDuvall

Outputs:
  MyVPC:
    Value: !Ref VPC
    Description: VPC ID - used by Cloud9
  PublicSubnet1: 
    Value: !Ref SubnetAPublic
    Description: SubnetAPublic - used by Cloud9
  PrivateSubnet1:
    Value: !Ref SubnetAPrivate
    Description: SubnetAPrivate - used by Cloud9, Lambda Function, and RDS::DBSubnetGroup

PaulDuvall

  MyRDSInstanceRotationSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Description: 'This is my rds instance secret'
      GenerateSecretString:
        SecretStringTemplate: '{"username": "admin"}'
        GenerateStringKey: 'password'
        PasswordLength: 16
        ExcludeCharacters: '"@/\'
      Tags: