Cloudformation template to create a CodePipeline and register a webhook on Github

codepipeline.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'CI/CD Pipeline'

Parameters:
    ArtifactsBucket:
        Type: String
    GithubOwner:
        Type: String
    GithubRepository:
        Type: String
    GithubBranch:
        Type: String
    CodeBuildProject:
        Type: String
    WebsiteBucket:
        Type: String

Resources:
    CodePipelineServiceRole:
        Type: 'AWS::IAM::Role'
        Properties:
            AssumeRolePolicyDocument:
                Version: 2012-10-17
                Statement:
                    - Effect: Allow
                      Principal:
                        Service:
                            - codepipeline.amazonaws.com
                      Action: 'sts:AssumeRole'
            Path: /
            Policies:
                - PolicyName: AWS-CodePipeline-Service-3
                  PolicyDocument:
                    Version: 2012-10-17
                    Statement:
                        - Effect: Allow
                          Action:
                            - 'codedeploy:CreateDeployment'
                            - 'codedeploy:GetApplicationRevision'
                            - 'codedeploy:GetDeployment'
                            - 'codedeploy:GetDeploymentConfig'
                            - 'codedeploy:RegisterApplicationRevision'
                          Resource: '*'
                        - Effect: Allow
                          Action:
                            - 'codebuild:BatchGetBuilds'
                            - 'codebuild:StartBuild'
                          Resource: '*'
                        - Effect: Allow
                          Action:
                            - 'iam:PassRole'
                          Resource: '*'
                        - Effect: Allow
                          Action:
                            - 'cloudwatch:*'
                            - 's3:*'
                          Resource: '*'

    CodePipeline:
        Type: 'AWS::CodePipeline::Pipeline'
        Properties:
            ArtifactStore:
                Type: S3
                Location: !Ref ArtifactsBucket
            RestartExecutionOnUpdate: true
            RoleArn: !GetAtt CodePipelineServiceRole.Arn
            Stages:
                - Name: Source
                  Actions:
                    - Name: SourceAction
                      ActionTypeId:
                        Category: Source
                        Owner: ThirdParty
                        Version: 1
                        Provider: GitHub
                      OutputArtifacts:
                        - Name: SourceOutput
                      Configuration:
                        Owner: !Ref GithubOwner
                        Repo: !Ref GithubRepository
                        Branch: !Ref GithubBranch
                        OAuthToken: '{{resolve:secretsmanager:GithubOAuthToken:SecretString:token}}'
                        PollForSourceChanges: false
                      RunOrder: 1
                      
                - Name: Build
                  Actions:
                    - Name: Artifact
                      ActionTypeId:
                        Category: Build
                        Owner: AWS
                        Version: 1
                        Provider: CodeBuild
                      InputArtifacts:
                        - Name: SourceOutput
                      OutputArtifacts:
                        - Name: BuildOutput
                      Configuration:
                        ProjectName: !Ref CodeBuildProject
                      RunOrder: 1
                      
                - Name: Deploy
                  Actions:
                    - Name: S3Deploy
                      ActionTypeId:
                        Category: Deploy
                        Owner: AWS
                        Provider: S3
                        Version: 1
                      InputArtifacts:
                        - Name: BuildOutput
                      Configuration: 
                        BucketName: !Ref WebsiteBucket
                        Extract: true
                      RunOrder: 1

    Webhook:
        Type: 'AWS::CodePipeline::Webhook'
        Properties:
            Authentication: GITHUB_HMAC
            AuthenticationConfiguration:
                SecretToken: '{{resolve:secretsmanager:GithubOAuthToken:SecretString:token}}'
            Filters:
                - JsonPath: $.ref
                  MatchEquals: 'refs/heads/{Branch}'
            TargetPipeline: !Ref CodePipeline
            TargetAction: SourceAction
            TargetPipelineVersion: !GetAtt CodePipeline.Version
            RegisterWithThirdParty: true