Rollout as a code (#161)

* feat: implement single CloudFormation template

* fix: remove old templates

* fix: remove whitespaces

* feat: attach domain name and its certificate to CloudFront distribution

* feat: add condition to attach aliases

* fix: add NoValue for default properties

* chore: minor change

* chore: fix description

* feat: ability to specify multiple domain names

* fix: replace secret's JSON creation to basic join func

* fix: don't ask for secret region, use us-east-1 by default

* fix: domainName to domainNames

* feat: add cfn-guard rules for the template

* feat: add GitHub action for cfn validation

* fix: fix call

* fix: fix paths

---------

Co-authored-by: Sergey Shelomentsev <sergey.shelomentsev@fingerprint.com>

.github/workflows/check-cloudformation.yml

@@ -0,0 +1,24 @@
+name: Rules to check CloudFormation template
+
+on:
+  pull_request:
+    paths:
+      - cloudformation/*
+
+jobs:
+  validate:
+    name: Validate template
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Install cfn-guard
+        run: curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/aws-cloudformation/cloudformation-guard/main/install-guard.sh | sh
+
+      - name: Validate
+        run: ~/.guard/bin/cfn-guard validate --rules cloudformation/rules.guard --data cloudformation/template.yml
+
+

cloudformation/rules.guard

@@ -0,0 +1,100 @@
+let SecretName = "FingerprintIntegrationSettings"
+let DistributionId = "ABCDEF123456"
+let FpjsBehaviorPath = "fpjs"
+let FpjsGetResultPath = "result"
+let FpjsAgentDownloadPath = "agent"
+let FpjsPreSharedSecret = "secret-string-123"
+
+rule check_conditions {
+    Conditions.CreateCloudFrontDistribution exists
+    Conditions.CreateCloudFrontDistribution is_struct
+
+    Conditions.AttachDomainToCloudFront exists
+    Conditions.AttachDomainToCloudFront is_struct
+}
+
+rule check_secret {
+    Resources.FingerprintIntegrationSettingsSecret {
+        Type == "AWS::SecretsManager::Secret"
+        Properties {
+            SecretString !empty
+        }
+    }
+}
+
+rule check_lambda {
+    Resources.FingerprintProCloudfrontLambda {
+        Type == "AWS::Serverless::Function"
+        Properties {
+            Handler == "fingerprintjs-pro-cloudfront-lambda-function.handler"
+            Runtime == "nodejs16.x"
+            CodeUri == "s3://fingerprint-pro-cloudfront-integration-lambda-function/release/lambda_latest.zip"
+        }
+    }
+}
+
+rule check_lambda_role {
+    Resources.FpIntLambdaFunctionExecutionRole {
+        Properties {
+            AssumeRolePolicyDocument {
+                some Statement[*].Principal.Service == "lambda.amazonaws.com"
+                some Statement[*].Principal.Service == "edgelambda.amazonaws.com"
+            }            
+        }
+    }
+}
+
+rule check_lambda_version {
+    Resources.FingerprintProCloudfrontLambdaVersion {
+        Type == "AWS::Lambda::Version"        
+    }
+}
+
+rule check_mgmt_lambda {
+    Resources.FingerprintProMgmtLambda {
+        Type == "AWS::Serverless::Function"
+        Properties {
+            Handler == "fingerprintjs-pro-cloudfront-mgmt-lambda-function.handler"
+            Runtime == "nodejs18.x"
+            CodeUri == "s3://fingerprint-pro-cloudfront-integration-lambda-function/release/mgmt_lambda_latest.zip"
+            Timeout == 120
+        }
+    }
+}
+
+rule check_mgmt_lambda_role {
+    Resources.FpMgmtLambdaFunctionExecutionRole {
+        Properties {
+            AssumeRolePolicyDocument {
+                some Statement[*].Principal.Service == "lambda.amazonaws.com"                
+            }
+        }
+    }
+}
+
+rule check_cache_policy {
+    Resources.FingerprintProCDNCachePolicy {
+        Type == "AWS::CloudFront::CachePolicy"
+        Properties {
+            CachePolicyConfig.MinTTL == 0
+            CachePolicyConfig.MaxTTL == 180
+            CachePolicyConfig.DefaultTTL == 180
+        }
+    }
+}
+
+rule check_cloudfront_distribution {
+    Resources.CloudFrontDistribution {
+        Type == "AWS::CloudFront::Distribution"
+        Condition exists
+    }
+}
+
+rule check_output {
+    Outputs {
+        LambdaFunctionName exists
+        CachePolicyName exists
+        CloudFrontDistributionId exists
+        IsCloudFrontDistributionCreatedByDeployment exists
+    }
+}