example-github-actions-codeguru-reviewer/template.yml at main · t3yamoto/example-github-actions-codeguru-reviewer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
Parameters:
  GitHubOrg:
    Type: String
  RepositoryName:
    Type: String
  OIDCProviderArn:
    Description: Arn for the GitHub OIDC Provider.
    Default: ""
    Type: String
  GitHubOIDCThumbprint:
    Description: GitHub OIDC thumbprint. see also https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html
    Default: 6938fd4d98bab03faadb97b34396831e3780aea1
    Type: String

Conditions:
  CreateOIDCProvider: !Equals
    - !Ref OIDCProviderArn
    - ""

Resources:
  CodeGuruReviewerBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub codeguru-reviewer-${AWS::AccountId}
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  CodeGuruReviewerRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonCodeGuruReviewerFullAccess
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRoleWithWebIdentity
            Principal:
              Federated: !If
                - CreateOIDCProvider
                - !Ref GithubOidcProvider
                - !Ref OIDCProviderArn
            Condition:
              StringLike:
                token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/${RepositoryName}:*

  CodeGuruReviewerS3Policy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - "s3:ListBucket"
            Resource:
              - !GetAtt CodeGuruReviewerBucket.Arn
          - Effect: Allow
            Action:
              - "s3:PutObject"
              - "s3:GetObject"
            Resource:
              - Fn::Join:
                - "/"
                - - !GetAtt CodeGuruReviewerBucket.Arn
                  - "*"
      PolicyName: code-guru-reviewer-s3-policy
      Roles:
        - !Ref CodeGuruReviewerRole

  GithubOidcProvider:
    Type: AWS::IAM::OIDCProvider
    Condition: CreateOIDCProvider
    Properties:
      Url: https://token.actions.githubusercontent.com
      ClientIdList:
        - sts.amazonaws.com
      ThumbprintList:
        - !Ref GitHubOIDCThumbprint

Outputs:
  CodeGuruReviewerBucketName:
    Value: !Ref CodeGuruReviewerBucket
  CodeGuruReviewerRoleArn:
    Value: !GetAtt CodeGuruReviewerRole.Arn
  GithubOidcProviderArn:
    Condition: CreateOIDCProvider
    Value: !GetAtt GithubOidcProvider.Arn