AWSTemplateFormatVersion: '2010-09-09'

Description: >
  Stack for provisioning the journey in AWS Mainframe Modernization Code Conversion with mLogica.
  
  **WARNING** There are AWS charges for the language transformation from Assembler to COBOL using AWS Mainframe Modernization Code Conversion with mLogica - *convert* step.
  Visit https://aws.amazon.com/mainframe-modernization/pricing/ for details.

  **WARNING** This template creates 1 Amazon S3 bucket, 4 AWS CodeBuild projects, 1 AWS IAM Role  and related resources. You will be billed for the AWS resources used if you create a stack from this template.
  
  1. Check security parameters/resources in the template.
  2. Check networking parameters/resources in the template.
  3. Submit the template in AWS CloudFormation from AWS Management Console or from terminal:aws cloudformation create-stack --stack-name stackAWSM2CCM --template-body  file://awsm2ccm.yml --capabilities CAPABILITY_NAMED_IAM
  4. To delete the stack, enter the following command: aws cloudformation delete-stack --stack-name stackAWSM2CCM

Parameters:

  ProjectBucket:
    Description: 'Project bucket in Amazon S3'
    Type: String
    Default: 'bucket-project-awsm2ccm-workshop'

  # Do not update. AWS documentation: https://docs.aws.amazon.com/m2/latest/userguide/assembler-conversion-components-process.html
  ContainerRepository:
    Description: 'AWS Mainframe Modernization Code Conversion with mLogica - Container repository'
    Type: String
    Default: '381492161314:repository/aws-mlogica-codebuild-prod'

  # Do not update. AWS documentation: https://docs.aws.amazon.com/m2/latest/userguide/assembler-conversion-components-process.html
  ContainerImage:
    Description: 'AWS Mainframe Modernization Code Conversion with mLogica - Container image'
    Type: String
    Default: '381492161314.dkr.ecr.us-east-1.amazonaws.com/aws-mlogica-codebuild-prod:latest'

  ProjectDir:
    Description: 'Project directory in project bucket'
    Type: String
    Default: 'prj_codebuild_01'

Resources:
  
  #Amazon S3 bucket.
  S3BucketProject:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      BucketName:
        Fn::Join:  
          - ''
          - - !Ref ProjectBucket
            - !Ref AWS::AccountId

  #AWS CodeBuild project: 1-awsm2ccm-define-project
  DefineProject:
    Type: AWS::CodeBuild::Project
    DeletionPolicy: Delete
    Properties:
      Name: '1-awsm2ccm-define-project'
      ServiceRole:
        Fn::GetAtt:
        - 'IAMRoleTaskExecutionRoleForCodeBuild'
        - 'Arn'
      Artifacts:
        Type: S3
        Location: !Ref S3BucketProject
        Path: ''
        NamespaceType: NONE
        Name: !Ref ProjectDir
        Packaging: NONE
        OverrideArtifactName: false
        EncryptionDisabled: false
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: !Ref ContainerImage
        PrivilegedMode: false
        ImagePullCredentialsType: SERVICE_ROLE
        EnvironmentVariables:
          - Name: PROJECT_BUCKET
            Value: !Ref S3BucketProject
            Type: PLAINTEXT
          - Name: PROJECT_DIR
            Value: !Ref ProjectDir
            Type: PLAINTEXT
          - Name: AWSM2CCM_ACTION
            Value: define_project
            Type: PLAINTEXT
          - Name: AWSM2CCM_LOGGING_BUCKET
            Value:
              Fn::Join:
                - ''
                - - 's3://' 
                  - !Ref S3BucketProject
            Type: PLAINTEXT
      Source:
        Type: NO_SOURCE
        BuildSpec: !Sub |
          version: 0.2
          phases:
            build:
              commands:
                - . /app/awsm2ccm_prod/bin/setup_env.sh
                - run_awsm2ccm.sh $PROJECT_DIR
          artifacts:
            files:
              - '**/*'
            discard-paths: no
            base-directory: $PROJECT_DIR        
        InsecureSsl: false
      TimeoutInMinutes: 60
      QueuedTimeoutInMinutes: 480
      LogsConfig:
        CloudWatchLogs:
          Status: ENABLED
        S3Logs:
          Status: ENABLED
          Location: 
            Fn::Join:
              - ''
              - - !Ref S3BucketProject
                - '/CODEBUILD-LOGS'          
          EncryptionDisabled: true
      Cache:
        Type: NO_CACHE

  #AWS CodeBuild project: 2-awsm2ccm-analysis
  Analysis:
    Type: AWS::CodeBuild::Project
    DeletionPolicy: Delete
    Properties:
      Name: '2-awsm2ccm-analysis'
      ServiceRole:
        Fn::GetAtt:
        - 'IAMRoleTaskExecutionRoleForCodeBuild'
        - 'Arn'
      Artifacts:
        Type: S3
        Location: !Ref S3BucketProject
        Path: ARTIFACTS
        NamespaceType: NONE
        Name: !Ref ProjectDir
        Packaging: NONE
        OverrideArtifactName: false
        EncryptionDisabled: false    
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: !Ref ContainerImage
        PrivilegedMode: false
        ImagePullCredentialsType: SERVICE_ROLE
        EnvironmentVariables:
          - Name: PROJECT_BUCKET
            Value: !Ref S3BucketProject
            Type: PLAINTEXT
          - Name: PROJECT_DIR
            Value: !Ref ProjectDir
            Type: PLAINTEXT
          - Name: AWSM2CCM_ACTION
            Value: analysis
            Type: PLAINTEXT
          - Name: AWSM2CCM_LOGGING_BUCKET
            Value:
              Fn::Join:
                - ''
                - - 's3://' 
                  - !Ref S3BucketProject
            Type: PLAINTEXT
      Source:
        Type: S3
        Location:
          Fn::Join:
            - ''
            - - !Ref S3BucketProject
              - '/'
              - !Ref ProjectDir
              - '/'
        BuildSpec: !Sub |
          version: 0.2
          phases:
            build:
              commands:
                - ln -s $CODEBUILD_SRC_DIR $PROJECT_DIR
                - . /app/awsm2ccm_prod/bin/setup_env.sh
                - run_awsm2ccm.sh $PROJECT_DIR
          artifacts:
            files:
              - '*.log'
              - '_Converted/*/*'
              - '_Reports/*'
            secondary-artifacts:
              reports:
                files:
                  - '_Reports/AWSM2CCM*'
            discard-paths: no
            base-directory: $PROJECT_DIR
        InsecureSsl: false
      TimeoutInMinutes: 60
      QueuedTimeoutInMinutes: 480
      LogsConfig:
        CloudWatchLogs:
          Status: ENABLED
        S3Logs:
          Status: ENABLED
          Location: 
            Fn::Join:
              - ''
              - - !Ref S3BucketProject
                - '/CODEBUILD-LOGS'          
          EncryptionDisabled: true
      Cache:
        Type: NO_CACHE

  #AWS CodeBuild project: 3-awsm2ccm-expand-macros
  ExpandMacros:
    Type: AWS::CodeBuild::Project
    DeletionPolicy: Delete
    Properties:
      Name: '3-awsm2ccm-expand-macros'
      ServiceRole:
        Fn::GetAtt:
        - 'IAMRoleTaskExecutionRoleForCodeBuild'
        - 'Arn'
      Artifacts:
        Type: S3
        Location: !Ref S3BucketProject
        Path: ARTIFACTS
        NamespaceType: NONE
        Name: !Ref ProjectDir
        Packaging: NONE
        OverrideArtifactName: false
        EncryptionDisabled: false
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: !Ref ContainerImage
        PrivilegedMode: false
        ImagePullCredentialsType: SERVICE_ROLE
        EnvironmentVariables:
          - Name: PROJECT_BUCKET
            Value: !Ref S3BucketProject
            Type: PLAINTEXT
          - Name: PROJECT_DIR
            Value: !Ref ProjectDir
            Type: PLAINTEXT
          - Name: AWSM2CCM_ACTION
            Value: expand_macros
            Type: PLAINTEXT
          - Name: AWSM2CCM_LOGGING_BUCKET
            Value:
              Fn::Join:
                - ''
                - - 's3://' 
                  - !Ref S3BucketProject
      Source:
        Type: S3
        Location:
          Fn::Join:
            - ''
            - - !Ref S3BucketProject
              - '/'
              - !Ref ProjectDir
              - '/'
        BuildSpec: !Sub |
          version: 0.2
          phases:
            build:
              commands:
                - ln -s $CODEBUILD_SRC_DIR $PROJECT_DIR
                - . /app/awsm2ccm_prod/bin/setup_env.sh
                - run_awsm2ccm.sh $PROJECT_DIR
          artifacts:
            files:
              - '*.log'
              - 'Macro_Expansion/Asm_with_Expanded_Macros/*'
            discard-paths: no
            base-directory: $PROJECT_DIR        
        InsecureSsl: false
      TimeoutInMinutes: 60
      QueuedTimeoutInMinutes: 480
      LogsConfig:
        CloudWatchLogs:
          Status: ENABLED
        S3Logs:
          Status: ENABLED
          Location: 
            Fn::Join:
              - ''
              - - !Ref S3BucketProject
                - '/CODEBUILD-LOGS'          
          EncryptionDisabled: true
      Cache:
        Type: NO_CACHE

  #AWS CodeBuild project: 4-awsm2ccm-convert
  Convert:
    Type: AWS::CodeBuild::Project
    DeletionPolicy: Delete
    Properties:
      Name: '4-awsm2ccm-convert'
      ServiceRole:
        Fn::GetAtt:
        - 'IAMRoleTaskExecutionRoleForCodeBuild'
        - 'Arn'
      Artifacts:
        Type: S3
        Location: !Ref S3BucketProject
        Path: ARTIFACTS
        NamespaceType: NONE
        Name: !Ref ProjectDir
        Packaging: NONE
        OverrideArtifactName: false
        EncryptionDisabled: false
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: !Ref ContainerImage
        PrivilegedMode: false
        ImagePullCredentialsType: SERVICE_ROLE
        EnvironmentVariables:
          - Name: PROJECT_BUCKET
            Value: !Ref S3BucketProject
            Type: PLAINTEXT
          - Name: PROJECT_DIR
            Value: !Ref ProjectDir
            Type: PLAINTEXT
          - Name: AWSM2CCM_ACTION
            Value: conversion
            Type: PLAINTEXT
          - Name: AWSM2CCM_LOGGING_BUCKET
            Value:
              Fn::Join:
                - ''
                - - 's3://' 
                  - !Ref S3BucketProject
      Source:
        Type: S3
        Location:
          Fn::Join:
            - ''
            - - !Ref S3BucketProject
              - '/'
              - !Ref ProjectDir
              - '/'
        BuildSpec: !Sub |
          version: 0.2
          phases:
            build:
              commands:
                - export AWSM2CCM_PUSH_RUNTIME_COPYBOOKS=y
                - ln -s $CODEBUILD_SRC_DIR $PROJECT_DIR
                - . /app/awsm2ccm_prod/bin/setup_env.sh
                - run_awsm2ccm.sh $PROJECT_DIR
          artifacts:
            files:
              - '*.log'
              - '_Converted/*/*'
              - '_Reports/*'
            discard-paths: no
            base-directory: $PROJECT_DIR 
        InsecureSsl: false
      TimeoutInMinutes: 60
      QueuedTimeoutInMinutes: 480
      LogsConfig:
        CloudWatchLogs:
          Status: ENABLED
        S3Logs:
          Status: ENABLED
          Location: 
            Fn::Join:
              - ''
              - - !Ref S3BucketProject
                - '/CODEBUILD-LOGS'          
          EncryptionDisabled: true
      Cache:
        Type: NO_CACHE

  #AWS IAM Role
  IAMRoleTaskExecutionRoleForCodeBuild:
    Type: AWS::IAM::Role
    DeletionPolicy: Delete
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - 'sts:AssumeRole'
          Effect: Allow
          Principal:
            Service: 
              - 'codebuild.amazonaws.com'
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: CodeBuildAWSM2CCMPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                - 's3:PutObject'
                - 's3:GetObject'
                - 's3:GetBucketLocation'
                - 's3:ListBucket'
                - 's3:PutObjectAcl'
                - 's3:GetBucketAcl'
                Resource:
                  - !Join 
                    - ''
                    - - 'arn:aws:s3:::'
                      - !Ref S3BucketProject
                  - !Join 
                    - ''
                    - - 'arn:aws:s3:::'
                      - !Ref S3BucketProject
                      - '/*'
                  - !Join 
                    - ''
                    - - 'arn:aws:s3:::'
                      - 'aws-m2-repo-*'
              - Effect: Allow
                Action:
                  - 'ecr:GetAuthorizationToken'
                Resource: '*'
              - Effect: Allow
                Action:
                - 'ecr:BatchCheckLayerAvailability'
                - 'ecr:BatchGetImage'
                - 'ecr:GetDownloadUrlForLayer'
                Resource:
                  - !Join 
                    - ''
                    - - 'arn:aws:ecr:*:'
                      - !Ref ContainerRepository
              - Effect: Allow
                Action:
                - 'logs:CreateLogGroup'
                - 'logs:CreateLogStream'
                - 'logs:PutLogEvents'
                Resource:
                  - !Join
                    - ':'
                    - - 'arn:aws:logs'
                      - !Ref 'AWS::Region'
                      - !Ref 'AWS::AccountId'
                      - 'log-group'
                      - '/aws/codebuild/1-awsm2ccm-define-project:*'
                  - !Join
                    - ':'
                    - - 'arn:aws:logs'
                      - !Ref 'AWS::Region'
                      - !Ref 'AWS::AccountId'
                      - 'log-group'
                      - '/aws/codebuild/2-awsm2ccm-analysis:*'
                  - !Join
                    - ':'
                    - - 'arn:aws:logs'
                      - !Ref 'AWS::Region'
                      - !Ref 'AWS::AccountId'
                      - 'log-group'
                      - '/aws/codebuild/3-awsm2ccm-expand-macros:*'
                  - !Join
                    - ':'
                    - - 'arn:aws:logs'
                      - !Ref 'AWS::Region'
                      - !Ref 'AWS::AccountId'
                      - 'log-group'
                      - '/aws/codebuild/4-awsm2ccm-convert:*'
              - Effect: Allow
                Action:
                - 'ec2:DescribeSecurityGroups'
                - 'ec2:DescribeSubnets'
                - 'ec2:DescribeNetworkInterfaces'
                - 'ec2:DeleteNetworkInterface'
                - 'ec2:CreateNetworkInterface'
                - 'ec2:DescribeDhcpOptions'
                - 'ec2:DescribeVpcs'
                - 'ec2:CreateNetworkInterfacePermission'
                Resource: '*'