deploy.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: RAPIDアプリケーションをデプロイするためのCodeBuildプロジェクト

Parameters:
  AllowedIpV4AddressRanges:
    Type: String
    Default: '["0.0.0.0/1","128.0.0.0/1"]'
    Description: フロントエンドWAFで許可するIPv4アドレス範囲（JSON配列形式）

  AllowedIpV6AddressRanges:
    Type: String
    Default: '["0000:0000:0000:0000:0000:0000:0000:0000/1","8000:0000:0000:0000:0000:0000:0000:0000/1"]'
    Description: フロントエンドWAFで許可するIPv6アドレス範囲（JSON配列形式）

  DisableIpv6:
    Type: String
    Default: "false"
    Description: IPv6サポートを無効にするかどうか
    AllowedValues: ["true", "false"]

  AutoMigrate:
    Type: String
    Default: "true"
    Description: デプロイ時に自動的にデータベースマイグレーションを実行するかどうか
    AllowedValues: ["true", "false"]

  CognitoSelfSignUpEnabled:
    Type: String
    Default: "true"
    Description: Cognito User Poolのセルフサインアップを有効にするかどうか
    AllowedValues: ["true", "false"]

  CognitoUserPoolId:
    Type: String
    Default: ""
    Description: 既存のCognito User Pool ID（指定しない場合は新規作成）

  CognitoUserPoolClientId:
    Type: String
    Default: ""
    Description: 既存のCognito User Pool Client ID（指定しない場合は新規作成）

  CognitoDomainPrefix:
    Type: String
    Default: ""
    Description: Cognitoドメインのプレフィックス（指定しない場合は自動生成）

  McpAdmin:
    Type: String
    Default: "false"
    Description: MCPランタイムLambda関数に管理者権限を付与するかどうか

  S3ApiGatewayFrontend:
    Type: String
    Default: "false"
    Description: フロントエンドをCloudFrontの代わりにS3+専用REGIONAL API Gateway（S3プロキシ）で配信するかどうか
    AllowedValues: ["true", "false"]

  ClosedNetwork:
    Type: String
    Default: "false"
    Description: 完全プライベートネットワークモード（S3+APIGWフロントエンドを含意）
    AllowedValues: ["true", "false"]

  AgentCoreNetworkMode:
    Type: String
    Default: "PUBLIC"
    Description: AgentCore Runtimeのネットワークモード（closedNetwork時のみ有効。PUBLIC=インターネットあり/MCP対応、VPC=完全分離）
    AllowedValues: ["PUBLIC", "VPC"]

  BedrockRegion:
    Type: String
    Default: "us-west-2"
    Description: Amazon Bedrockを利用するリージョン

  DocumentProcessingModelId:
    Type: String
    Default: ""
    Description: ドキュメント処理に使用するAIモデルID

  ImageReviewModelId:
    Type: String
    Default: ""
    Description: 画像レビューに使用するAIモデルID

  RepoUrl:
    Type: String
    Default: "https://github.com/aws-samples/review-and-assessment-powered-by-intelligent-documentation.git"
    Description: デプロイするリポジトリのURL

  Branch:
    Type: String
    Default: "main"
    Description: デプロイするブランチ名

  GitTag:
    Type: String
    Default: ""
    Description: デプロイするGitタグ名（指定した場合はブランチよりも優先されます）

Resources:
  ProjectRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
        Version: "2012-10-17"
      ManagedPolicyArns:
        - Fn::Join:
            - ""
            - - "arn:"
              - Ref: AWS::Partition
              - :iam::aws:policy/AdministratorAccess

  ProjectRoleDefaultPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Effect: Allow
            Resource:
              - Fn::Join:
                  - ""
                  - - "arn:"
                    - Ref: AWS::Partition
                    - ":logs:"
                    - Ref: AWS::Region
                    - ":"
                    - Ref: AWS::AccountId
                    - :log-group:/aws/codebuild/
                    - Ref: Project
                    - :*
              - Fn::Join:
                  - ""
                  - - "arn:"
                    - Ref: AWS::Partition
                    - ":logs:"
                    - Ref: AWS::Region
                    - ":"
                    - Ref: AWS::AccountId
                    - :log-group:/aws/codebuild/
                    - Ref: Project
          - Action:
              - codebuild:BatchPutCodeCoverages
              - codebuild:BatchPutTestCases
              - codebuild:CreateReport
              - codebuild:CreateReportGroup
              - codebuild:UpdateReport
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - "arn:"
                  - Ref: AWS::Partition
                  - ":codebuild:"
                  - Ref: AWS::Region
                  - ":"
                  - Ref: AWS::AccountId
                  - :report-group/
                  - Ref: Project
                  - -*
        Version: "2012-10-17"
      PolicyName: ProjectRoleDefaultPolicy
      Roles:
        - Ref: ProjectRole

  Project:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: NO_ARTIFACTS
      Cache:
        Type: NO_CACHE
      EncryptionKey: alias/aws/s3
      Environment:
        # Ref: https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-compute-types.html
        ComputeType: BUILD_GENERAL1_MEDIUM
        Image: aws/codebuild/amazonlinux-aarch64-standard:3.0
        ImagePullCredentialsType: CODEBUILD
        PrivilegedMode: true
        Type: ARM_CONTAINER
        EnvironmentVariables:
          - Name: ALLOWED_IPV4_RANGES
            Value: !Ref AllowedIpV4AddressRanges
          - Name: ALLOWED_IPV6_RANGES
            Value: !Ref AllowedIpV6AddressRanges
          - Name: DISABLE_IPV6
            Value: !Ref DisableIpv6
          - Name: AUTO_MIGRATE
            Value: !Ref AutoMigrate
          - Name: COGNITO_SELF_SIGNUP_ENABLED
            Value: !Ref CognitoSelfSignUpEnabled
          - Name: COGNITO_USER_POOL_ID
            Value: !Ref CognitoUserPoolId
          - Name: COGNITO_USER_POOL_CLIENT_ID
            Value: !Ref CognitoUserPoolClientId
          - Name: COGNITO_DOMAIN_PREFIX
            Value: !Ref CognitoDomainPrefix
          - Name: MCP_ADMIN
            Value: !Ref McpAdmin
          - Name: S3_API_GATEWAY_FRONTEND
            Value: !Ref S3ApiGatewayFrontend
          - Name: CLOSED_NETWORK
            Value: !Ref ClosedNetwork
          - Name: AGENT_CORE_NETWORK_MODE
            Value: !Ref AgentCoreNetworkMode
          - Name: BEDROCK_REGION
            Value: !Ref BedrockRegion
          - Name: DOCUMENT_PROCESSING_MODEL_ID
            Value: !Ref DocumentProcessingModelId
          - Name: IMAGE_REVIEW_MODEL_ID
            Value: !Ref ImageReviewModelId
          - Name: REPO_URL
            Value: !Ref RepoUrl
          - Name: BRANCH
            Value: !Ref Branch
          - Name: GIT_TAG
            Value: !Ref GitTag
      ServiceRole:
        Fn::GetAtt:
          - ProjectRole
          - Arn
      Source:
        BuildSpec: |-
          {
            "version": 0.2,
            "phases": {
              "install": {
                "runtime-versions": {
                  "nodejs": "20"
                },
                "on-failure": "ABORT",
                "commands": [
                  "npm install -g npm@latest"
                ]
              },
              "build": {
                "commands": [
                  "echo 'ビルドフェーズを開始します...'",
                  "if [ ! -z \"$GIT_TAG\" ]; then\n  git clone $REPO_URL rapid\n  cd rapid\n  git checkout $GIT_TAG\n  cd ..\nelse\n  git clone --branch $BRANCH $REPO_URL rapid\nfi",
                  "cd rapid",
                  "echo 'パラメータを設定中...'",
                  "echo '/**' > cdk/lib/parameter.ts",
                  "echo ' * CDKデプロイのカスタムパラメータ設定ファイル' >> cdk/lib/parameter.ts",
                  "echo ' *' >> cdk/lib/parameter.ts",
                  "echo ' * このファイルは、CDKデプロイ時に使用するパラメータをカスタマイズするためのものです。' >> cdk/lib/parameter.ts",
                  "echo ' * デプロイスクリプトによって自動生成されました。' >> cdk/lib/parameter.ts",
                  "echo ' */' >> cdk/lib/parameter.ts",
                  "echo '' >> cdk/lib/parameter.ts",
                  "echo 'export const parameters = {' >> cdk/lib/parameter.ts",
                  "echo '  // WAF IP制限の設定' >> cdk/lib/parameter.ts",
                  "echo '  allowedIpV4AddressRanges: '$ALLOWED_IPV4_RANGES',' >> cdk/lib/parameter.ts",
                  "echo '  allowedIpV6AddressRanges: '$ALLOWED_IPV6_RANGES',' >> cdk/lib/parameter.ts",
                  "echo '' >> cdk/lib/parameter.ts",
                  "echo '  // Prismaマイグレーション設定' >> cdk/lib/parameter.ts",
                  "if [ \"$AUTO_MIGRATE\" = \"true\" ]; then echo '  autoMigrate: true,' >> cdk/lib/parameter.ts; else echo '  autoMigrate: false,' >> cdk/lib/parameter.ts; fi",
                  "echo '' >> cdk/lib/parameter.ts",
                  "echo '  // Cognito設定' >> cdk/lib/parameter.ts",
                  "if [ \"$COGNITO_SELF_SIGNUP_ENABLED\" = \"true\" ]; then echo '  cognitoSelfSignUpEnabled: true,' >> cdk/lib/parameter.ts; else echo '  cognitoSelfSignUpEnabled: false,' >> cdk/lib/parameter.ts; fi",
                  "if [ ! -z \"$COGNITO_USER_POOL_ID\" ]; then echo '  cognitoUserPoolId: \"'$COGNITO_USER_POOL_ID'\",' >> cdk/lib/parameter.ts; fi",
                  "if [ ! -z \"$COGNITO_USER_POOL_CLIENT_ID\" ]; then echo '  cognitoUserPoolClientId: \"'$COGNITO_USER_POOL_CLIENT_ID'\",' >> cdk/lib/parameter.ts; fi",
                  "if [ ! -z \"$COGNITO_DOMAIN_PREFIX\" ]; then echo '  cognitoDomainPrefix: \"'$COGNITO_DOMAIN_PREFIX'\",' >> cdk/lib/parameter.ts; fi",
                  "echo '' >> cdk/lib/parameter.ts",
                  "echo '  // Bedrock設定' >> cdk/lib/parameter.ts",
                  "echo '  bedrockRegion: \"'$BEDROCK_REGION'\",' >> cdk/lib/parameter.ts",
                  "if [ ! -z \"$DOCUMENT_PROCESSING_MODEL_ID\" ]; then echo '  documentProcessingModelId: \"'$DOCUMENT_PROCESSING_MODEL_ID'\",' >> cdk/lib/parameter.ts; fi",
                  "if [ ! -z \"$IMAGE_REVIEW_MODEL_ID\" ]; then echo '  imageReviewModelId: \"'$IMAGE_REVIEW_MODEL_ID'\",' >> cdk/lib/parameter.ts; fi",
                  "echo '' >> cdk/lib/parameter.ts",
                  "echo '  // MCP設定' >> cdk/lib/parameter.ts",
                  "if [ \"$MCP_ADMIN\" = \"true\" ]; then echo '  mcpAdmin: true,' >> cdk/lib/parameter.ts; else echo '  mcpAdmin: false,' >> cdk/lib/parameter.ts; fi",
                  "echo '' >> cdk/lib/parameter.ts",
                  "echo '  // ネットワークモード設定' >> cdk/lib/parameter.ts",
                  "if [ \"$S3_API_GATEWAY_FRONTEND\" = \"true\" ]; then echo '  s3ApiGatewayFrontend: true,' >> cdk/lib/parameter.ts; fi",
                  "if [ \"$CLOSED_NETWORK\" = \"true\" ]; then echo '  closedNetwork: true,' >> cdk/lib/parameter.ts; fi",
                  "if [ ! -z \"$AGENT_CORE_NETWORK_MODE\" ]; then echo '  agentCoreNetworkMode: \"'$AGENT_CORE_NETWORK_MODE'\",' >> cdk/lib/parameter.ts; fi",
                  "echo '};' >> cdk/lib/parameter.ts",
                  "echo 'パラメータファイルを作成しました:'",
                  "cat cdk/lib/parameter.ts",
                  "echo 'バックエンドの準備...'",
                  "cd backend",
                  "npm ci",
                  "npm run prisma:generate",
                  "npm run build",
                  "cd ../cdk",
                  "echo 'CDKデプロイの準備...'",
                  "npm ci",
                  "echo 'CDKデプロイを実行中...'",
                  "npx cdk bootstrap",
                  "npx cdk deploy --all --require-approval never"
                ]
              },
              "post_build": {
                "commands": [
                  "echo 'デプロイ完了！'",
                  "FRONTEND_URL=$(aws cloudformation describe-stacks --stack-name RapidStack --query \"Stacks[0].Outputs[?OutputKey=='FrontendURL'].OutputValue\" --output text)",
                  "API_URL=$(aws cloudformation describe-stacks --stack-name RapidStack --query \"Stacks[0].Outputs[?OutputKey=='ApiUrl'].OutputValue\" --output text)",
                  "echo \"フロントエンドURL: $FRONTEND_URL\"",
                  "echo \"API URL: $API_URL\"",
                  "echo \"FrontendURL = $FRONTEND_URL\""
                ]
              }
            }
          }
        Type: NO_SOURCE

Outputs:
  ProjectName:
    Value:
      Ref: Project
    Description: CodeBuildプロジェクト名