Codebuild notification using SNS in Cloudformation

Question

I have created the following cloudformation template to create SNS Topic, Subscription and Cloudwatch rule to send notification if a codebuild is failed. And When i tried creating, it was failing during creation of Cloudwatch rule with the below issue:

Invalid InputTemplate for target CodeBuildNotifications : [Source: (String)"Build null for build project null has reached the build status of null. Logs are here: null"; line: 1, column: 6]. (Service: AmazonCloudWatchEvents; Status Code: 400; Error Code: ValidationException; Request ID: 1f2834f6-f809-4f47-9e8f-585c2be81ffb; Proxy: null)

Below is the template yaml used for this.

---
AWSTemplateFormatVersion: '2010-09-09'
Description: Creates SNS topic, SNS subscription and Cloudwatch rule for Codebuild Notification
Parameters:
  SubscriptionEndPoint:
    Type: String
    Description: The endpoint that receives notifications.
  SubscriptionProtocol:
    Type: String
    Description: The subscription protocol
    AllowedValues:
    - http
    - https
    - email
    - email-json
    - sms
    - sqs
    - application
    - lambda
    Default: email
Mappings: {}
Conditions: {}
Resources:
  SNSTopic:
    Type: AWS::SNS::Topic
    Properties: {}
  SNSSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      Protocol:
        Ref: SubscriptionProtocol
      Endpoint:
        Ref: SubscriptionEndPoint
      TopicArn:
        Ref: SNSTopic
  CodebuildStateFailureEventRule:
    Type: "AWS::Events::Rule"
    Properties:
      Description: "Rule for sending failure notifications to SNS topic"
      EventPattern:
        source:
          - aws.codebuild
        detail-type:
          - CodeBuild Build State Change
        detail:
          project-name:
            - TestCodeBuildProject
          build-status:
            - FAILED
      State: "ENABLED"
      Targets:
        - Arn:
            Ref: CodebuildNotifications
          Id: CodeBuildNotificationTest
          InputTransformer:            
            InputPathsMap:
              build-id: "$.detail.build-id"
              project-name: "$.detail.project-name"
              build-status: "$.detail.build-status"
              deep-link: "$.detail.additional-information.logs.deep-link" 
            InputTemplate:
              "Build '<build-id>' for build project '<project-name>' has reached the build status of '<build-status>'."
Outputs:
  QueueName:
    Description: Name of the SNS Topic we created
    Value:
      Fn::GetAtt:
      - SNSTopic
      - TopicName
  TopicARN:
    Description: ARN of the SNS Topic we created 
    Value:
      Ref: SNSTopic

I am new to cloudformation, and there is some issue with InputTransformer which I configured. Can anyone please help on this ?

Thanks in Advance

What is CodebuildNotifications? Its not defined in your code. — Marcin
I tried with this ARN as well and it doesn't work - Arn: !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:CodebuildNotifications" — Kivi
But what is CodebuildNotifications? sns topic name? Your code does not define such a value. — Marcin
CodebuildNotifications is defined in the Target ID. I referred this site to use this template - blog.rocketinsights.com/cicd-with-codebuild-and-codepipeline — Kivi

Marcin Marcin · Accepted Answer · 2021-06-10T06:47:52

For the sns target, you should use Arn: !Ref SNSTopic. Also you forgot about | in your InputTemplate:

AWSTemplateFormatVersion: '2010-09-09'
Description: Creates SNS topic, SNS subscription and Cloudwatch rule for Codebuild Notification
Parameters:
  SubscriptionEndPoint:
    Type: String
    Description: The endpoint that receives notifications.
  SubscriptionProtocol:
    Type: String
    Description: The subscription protocol
    AllowedValues:
    - http
    - https
    - email
    - email-json
    - sms
    - sqs
    - application
    - lambda
    Default: email
Mappings: {}
Conditions: {}
Resources:
  SNSTopic:
    Type: AWS::SNS::Topic
    Properties: {}
  SNSSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      Protocol:
        Ref: SubscriptionProtocol
      Endpoint:
        Ref: SubscriptionEndPoint
      TopicArn:
        Ref: SNSTopic

  SnsPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties: 
      Topics: [!Ref SNSTopic]         
      PolicyDocument: !Sub |
          {
            "Version": "2012-10-17",
            "Id": "__default_policy_ID",
            "Statement": [
              {
                "Sid": "__default_statement_ID",
                "Effect": "Allow",
                "Principal": {
                  "AWS": "*"
                },
                "Action": [
                  "SNS:GetTopicAttributes",
                  "SNS:SetTopicAttributes",
                  "SNS:AddPermission",
                  "SNS:RemovePermission",
                  "SNS:DeleteTopic",
                  "SNS:Subscribe",
                  "SNS:ListSubscriptionsByTopic",
                  "SNS:Publish",
                  "SNS:Receive"
                ],
                "Resource": "${SNSTopic}",
                "Condition": {
                  "StringEquals": {
                    "AWS:SourceOwner": "${AWS::AccountId}"
                  }
                }
              },
              {
                "Sid": "Allow EVENts",
                "Effect": "Allow",
                "Principal": {
                  "Service": "events.amazonaws.com"
                },
                "Action": "sns:Publish",
                "Resource": "${SNSTopic}"
              }
            ]
          }


  CodebuildStateFailureEventRule:
    Type: "AWS::Events::Rule"
    Properties:
      Description: "Rule for sending failure notifications to SNS topic"
      EventPattern:
        source:
          - aws.codebuild
        detail-type:
          - CodeBuild Build State Change
        detail:
          project-name:
            - TestCodeBuildProject
          build-status:
            - FAILED
      State: "ENABLED"
      Targets:
       - Arn: !Ref SNSTopic
         Id: CodeBuildNotificationTest
         InputTransformer:
            InputPathsMap:
              build-id: "$.detail.build-id"
              project-name: "$.detail.project-name"
              build-status: "$.detail.build-status"
              deep-link: "$.detail.additional-information.logs.deep-link"
            InputTemplate: |
              "Build '<build-id>' for build project '<project-name>' has reached the build status of '<build-status>'."
Outputs:
  QueueName:
    Description: Name of the SNS Topic we created
    Value:
      Fn::GetAtt:
      - SNSTopic
      - TopicName
  TopicARN:
    Description: ARN of the SNS Topic we created
    Value:
      Ref: SNSTopic

Probably you will still need to setup permissions between SNS and Events, but template should deploy now.

Codebuild notification using SNS in Cloudformation

1 Answers