異なるAWSアカウントでBlue/Green自動デプロイする（クロスアカウントデプロイ@ECS Fargate）

  # ------------------------------------------------------------#
  #  Cross Account Role For Develop Account
  # ------------------------------------------------------------#
  ECRRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${TargetAccountId}:root #開発環境のアカウントIDをParameterに設定
          Action: sts:AssumeRole 
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess #必要に応じ権限を絞る
      RoleName: auto-deploy-for-fargate

  # ------------------------------------------------------------#
  #  Bucket For DeploySetting 
  # ------------------------------------------------------------#
  ECSDeploySettingBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${Env}-${ServiceName}-auto-deploy
      VersioningConfiguration:
        Status: Enabled
  ECSDeploySettingBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ECSDeploySettingBucket
      PolicyDocument:
        Id: "Allow-Cross-Account-Access"
        Version: '2012-10-17'
        Statement:
          - Sid: CrossAccountBucketPolicy
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${TargetAccountId}:root #開発環境のアカウントIDをParameterに設定
            Action:
              - s3:*
            Resource: !Sub arn:aws:s3:::${Env}-${ServiceName}-auto-deploy/*

 - echo ########## 【Production】 Prepare Deploy Settings ... on `date`
 - PROD_REPOSITORY_URI=${PROD_ACCOUNT_ID}.dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com/${IMAGE_NAME}  #本番のアカウントIDでURIを生成
 - docker tag $REPOSITORY_URI:latest $PROD_REPOSITORY_URI:latest
 - docker tag $REPOSITORY_URI:$IMAGE_TAG $PROD_REPOSITORY_URI:$IMAGE_TAG
 - sed -i -e "s/__ACOUNTID__/$PROD_ACCOUNT_ID/" .prod-config  #クレデンシャルファイルを本番のアカウントIDで置換
 - echo ########## 【Production】 Pushing the Docker image ... on `date`
 - export AWS_CONFIG_FILE=.prod-config #クレデンシャルファイルパスを環境変数から設定
 - $(aws ecr get-login --no-include-email --region $AWS_DEFAULT_REGION --profile cross-account-role) #本番環境で付与したアカウントでECRにログインする
 - docker push $PROD_REPOSITORY_URI:latest #本番アカウントにイメージPush
 - docker push $PROD_REPOSITORY_URI:$IMAGE_TAG
 - echo ########## 【Production】 Writing Task Definitions file...
 - sed -i -e "s/__ACOUNTID__/$PROD_ACCOUNT_ID/" taskdef.json  #タスク定義ファイルを本番のアカウントIDで置換
 - echo ########## 【Production】 Writing image definitions file...
 - printf '{"Version":"1.0","ImageURI":"%s"}' $PROD_REPOSITORY_URI:$IMAGE_TAG > imageDetail.json #イメージ定義ファイルの書き出し
 - echo ########## 【Production】 Sync Deploy Setting file...
 - aws s3 cp appspec.yaml s3://prod-sample-app-auto-deploy/ --acl bucket-owner-full-control #本番アカウントでアクセスできるようにbucket-owner-full-controlオプション付与
 - aws s3 cp taskdef.json s3://prod-sample-app-auto-deploy/ --acl bucket-owner-full-control
 - aws s3 cp imageDetail.json s3://prod-sample-app-auto-deploy/ --acl bucket-owner-full-control

[profile cross-account-role]
credential_source = EcsContainer
role_arn = arn:aws:iam::__ACOUNTID__:role/auto-deploy-for-fargate ## 1.で作成したロール ※アカウントIDを置換

{
  "executionRoleArn": "arn:aws:iam::__ACOUNTID__:role/sample-app-ECSTaskExecutionRole", ## アカウントIDを置換
  "containerDefinitions": [
    {
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/var/log/sample-app",
          "awslogs-region": "ap-northeast-1",
          "awslogs-stream-prefix": "front"
        }
      },
      "portMappings": [
        {
          "hostPort": 80,
          "protocol": "tcp",
          "containerPort": 80
        }
      ],
      "image": "<IMAGE_NAME>",
      "name": "front"
    }
  ],
  "memory": "512",
  "compatibilities": ["EC2", "FARGATE"],
  "family": "sample-app-front",
  "requiresCompatibilities": ["FARGATE"],
  "networkMode": "awsvpc",
  "cpu": "256"
}

{"Version":"1.0","ImageURI":"__ACOUNTID__.dkr.ecr.ap-northeast-1.amazonaws.com/sample-app:ec5b627"}

  BuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: CODEPIPELINE
      Source:
        Type: CODEPIPELINE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                docker: 18
            post_build:
              commands:
                - aws s3 cp s3://prod-sample-app-auto-deploy/appspec.yaml . ## 連携されたデプロイ設定ファイルを取得
                - aws s3 cp s3://prod-sample-app-auto-deploy/taskdef.json .
                - aws s3 cp s3://prod-sample-app-auto-deploy/imageDetail.json .
                - cat imageDetail.json
          artifacts:
            files:
                - appspec.yaml
                - taskdef.json
                - imageDetail.json
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:3.0
        Type: LINUX_CONTAINER
        PrivilegedMode: true
      LogsConfig:
        CloudWatchLogs:
          Status: ENABLED
      Name: !Sub ${ServiceName}-codebuild
      ServiceRole: !Ref CodeBuildServiceRole

  BuildPipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Name: !Sub ${ServiceName}-codepipeline
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref ECSDeploySettingBucket
      Stages:
      - Name: Source
        Actions:
        - ActionTypeId:
            Category: Source
            Owner: AWS
            Provider: ECR ## ECR Push Trigger
            Version: 1
          Name: Source
          Configuration: 
            RepositoryName: !Ref ServiceName
          OutputArtifacts:
            - Name: BuildSource
          RunOrder: 1
      - Name: Build
        Actions:
        - ActionTypeId:
            Category: Build
            Owner: AWS
            Provider: CodeBuild
            Version: 1
          Name: Build
          Configuration:
            ProjectName: !Ref BuildProject
          InputArtifacts:
            - Name: BuildSource
          OutputArtifacts:
            - Name: BuildOutPut
          RunOrder: 1