terraform-aws-lambda/examples/deployment/complete/codepipeline_step.tf at main · HotelEngine/terraform-aws-lambda · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
locals {
  codebuild_name = "custom-pipeline-step"
}

resource "aws_cloudwatch_log_group" "custom_step" {
  name              = "/aws/codebuild/${local.codebuild_name}"
  retention_in_days = 1
}

resource "aws_codebuild_project" "custom_step" {
  name         = local.codebuild_name
  service_role = aws_iam_role.custom_codepipeline_step.arn

  artifacts {
    type = "CODEPIPELINE"
  }

  logs_config {
    cloudwatch_logs {
      group_name = aws_cloudwatch_log_group.custom_step.name
      status     = "ENABLED"
    }

    s3_logs {
      status = "DISABLED"
    }
  }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "aws/codebuild/amazonlinux2-x86_64-standard:5.0"
    type         = "LINUX_CONTAINER"
  }

  source {
    type      = "CODEPIPELINE"
    buildspec = templatefile("${path.module}/codepipeline_step/buildspec.yml", { script = file("${path.module}/codepipeline_step/step.py") })
  }
}

data "aws_iam_policy_document" "custom_codepipeline_step" {
  statement {
    sid = "Logging"

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents"
    ]

    resources = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/codebuild/*"]
  }

  # Required for code build to access the code pipeline artifact bucket
  # to be modified depending on input artifacts
  statement {
    sid = "S3BuildArtifactAccess"

    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion"
    ]

    #trivy:ignore:AVD-AWS-0057
    resources = ["${module.deployment.codepipeline_artifact_storage_arn}/deploy/*"]
  }
}

resource "aws_iam_policy" "custom_codepipeline_step" {
  name   = "${local.codebuild_name}-${data.aws_region.current.name}"
  policy = data.aws_iam_policy_document.custom_codepipeline_step.json
}

resource "aws_iam_role_policy_attachment" "custom_codepipeline_step" {
  role       = aws_iam_role.custom_codepipeline_step.name
  policy_arn = aws_iam_policy.custom_codepipeline_step.arn
}

resource "aws_iam_role" "custom_codepipeline_step" {
  name = "${local.codebuild_name}-${data.aws_region.current.name}"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          Service = "codebuild.amazonaws.com"
        }
      },
    ]
  })
}

# Required for code pipeline to execute custom code build steps
data "aws_iam_policy_document" "codepipeline_execution" {
  statement {
    sid = "CustomCodeBuild"

    actions = [
      "codebuild:BatchGetBuilds",
      "codebuild:StartBuild",
    ]

    resources = [aws_codebuild_project.custom_step.arn]
  }
}

resource "aws_iam_policy" "codepipeline_execution" {
  name   = "allow-${local.codebuild_name}-${data.aws_region.current.name}"
  policy = data.aws_iam_policy_document.codepipeline_execution.json
}

resource "aws_iam_policy_attachment" "codepipeline_execution" {
  name       = "allow-${local.codebuild_name}-${data.aws_region.current.name}"
  policy_arn = aws_iam_policy.codepipeline_execution.arn
  roles      = [module.deployment.codepipeline_role_name]
}