With the pursuit of DevOps automation and CI/CD (Continuous Integration/Continuous Delivery), many companies are now migrating their applications onto the AWS cloud to take advantage of the service capabilities AWS has to offer. AWS provides native tools to help achieve CI/CD and one of the most core services they provide for that is AWS CodePipeline. CodePipeline is a service that allows a user to build a CI/CD pipeline for the automated build, test, and deployment of applications.
A common practice in using CodePipeline for CI/CD is to be able to automatically deploy applications into multiple lower environments before reaching production. These lower environments for deployed applications could be used for development, testing, business validation, and other use cases. As a CodePipeline progresses through its stages, it is often required by businesses that there are manual approval gates in between the deployments to further environments.
Each time a CodePipeline reaches one of these manual approval gates, a human is required to log into the console and manually either approve (allow pipeline to continue) or reject (stop the pipeline from continuing) the gate. Often times different teams or divisions of a business are responsible for their own application environments and, as a result of that, are also responsible for either allowing or rejecting a pipeline to continue deployment in their environment via the relative manual approval gate.
A problem that a business may run into is trying to figure out a way to easily keep track of who is approving/rejecting which approval gates and in which pipelines. With potentially hundreds of pipelines deployed in an account, it may be very difficult to keep track of and record approval gate actions through manual processes. For auditing situations, this can create a cumbersome problem as there may eventually be a need to provide evidence of why a specific pipeline was approved/rejected on a certain date and the reasoning behind the result.
So how can we keep a long term record of CodePipeline manual approval gate actions in an automated, scalable, and organized fashion? Through the use of AWS CloudTrail, AWS Lambda, AWS CloudWatch Events, AWS S3, and AWS SNS we can create a solution that provides this type of record keeping.
Each time someone approves/rejects an approval gate within an CodePipeline, that API call is logged in CloudTrail under the event name of “PutApprovalResult”. Through the use of an AWS CloudWatch event rule, we can configure that rule to listen for that specific CloudTrail API action and trigger a Lambda function to perform a multitude of tasks. This what that CloudTrail event looks like inside the AWS console.
{
"eventVersion": "1.05",
"userIdentity": {
"type": "AssumedRole",
"principalId": "AAAABBBCCC111222333:newuser",
"arn": "arn:aws:sts::12345678912:assumed-role/IamOrg/newuser",
"accountId": "12345678912",
"accessKeyId": "1111122222333334444455555",
"sessionContext": {
"attributes": {
"mfaAuthenticated": "true",
"creationDate": "2019-05-23T15:02:42Z"
},
"sessionIssuer": {
"type": "Role",
"principalId": "1234567093756383847",
"arn": "arn:aws:iam::12345678912:role/OrganizationAccountAccessRole",
"accountId": "12345678912",
"userName": "newuser"
}
}
},
"eventTime": "2019-05-23T16:01:25Z",
"eventSource": "codepipeline.amazonaws.com",
"eventName": "PutApprovalResult",
"awsRegion": "us-east-1",
"sourceIPAddress": "1.1.1.1",
"userAgent": "aws-internal/3 aws-sdk-java/1.11.550 Linux/4.9.137-0.1.ac.218.74.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.212-b03 java/1.8.0_212 vendor/Oracle_Corporation",
"requestParameters": {
"pipelineName": "testing-pipeline",
"stageName": "qa-approval",
"actionName": "qa-approval",
"result": {
"summary": "I approve",
"status": "Approved"
},
"token": "123123123-abcabcabc-123123123-abcabc"
},
"responseElements": {
"approvedAt": "May 23, 2019 4:01:25 PM"
},
"requestID": "12345678-123a-123b-123c-123456789abc",
"eventID": "12345678-123a-123b-123c-123456789abc",
"eventType": "AwsApiCall",
"recipientAccountId": "12345678912"
}
When that CloudWatch event rule is triggered, the Lambda function that it executes can be configured to perform multiple tasks including:
- Capture the CloudTrail event log data from that “PutApprovalResult” API call and log it into the Lambda functions CloudWatch log group.
- Create a dated text file entry in a S3 bucket containing useful and unique information about the pipeline manual approval gate action.
- Send out an email notification containing unique information about the pipeline manual approval gate action.
The CloudWatch Event Rule provides a way to narrow down and capture the specific CloudTrail event named “PutApprovalResult”. Below is a snippet of this event rule defined in AWS CloudFormation.
ApprovalGateEventRule:
Type: AWS::Events::Rule
Properties:
Description: Event Rule that tracks whenever someone approves/rejects an approval gate in a pipeline
EventPattern:
{
"source": [
"aws.codepipeline"
],
"detail-type": [
"AWS API Call via CloudTrail"
],
"detail": {
"eventSource": [
"codepipeline.amazonaws.com"
],
"eventName": [
"PutApprovalResult"
]
}
}
The Lambda Function provides the automation and scalability needed to perform this type of approval gate tracking at any scale. The SNS topic provides the ability to send out email alerts whenever someone approves or rejects a manual approval gate in any pipeline.
The recorded text file entries in the S3 bucket provide the long term and durable storage solution to keeping track of CodePipeline manual approval gate results. To ensure an easy way to go back and discover those results, it is best to organize those entries in an appropriate manner such as by “pipeline_name/year/month/day/gate_name_timed_entry.txt“. An example of a recording could look like this:
PipelineApprovalGateActions/testing-pipeline/2019/05/23/dev-approval-APPROVED-11:50:45-AM.txt
Below is a diagram of a solution that can provide the features described above.
The source code and CloudFormation template for a fully built out implementation of this solution can be found here codepipeline-approval-gate-tracking.
To deploy this solution right now, click the Launch Stack button below.
Additional Resources
|
Stelligent Amazon Pollycast
 |
