diff --git a/README.md b/README.md index 8054c04..e4ef341 100644 --- a/README.md +++ b/README.md @@ -39,6 +39,7 @@ This project creates and manages resources within an AWS account for infrastruct | [aws_codebuild_project.infrastructure_ecs_cluster_service_build](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_project) | resource | | [aws_codepipeline.infrastructure_ecs_cluster_service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codepipeline) | resource | | [aws_default_network_acl.infrastructure](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_network_acl) | resource | +| [aws_ecr_repository.infrastructure_ecs_cluster_service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecr_repository) | resource | | [aws_ecs_cluster.infrastructure](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_cluster) | resource | | [aws_efs_file_system.infrastructure_ecs_cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/efs_file_system) | resource | | [aws_efs_mount_target.infrastructure_ecs_cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/efs_mount_target) | resource | @@ -61,6 +62,7 @@ This project creates and manages resources within an AWS account for infrastruct | [aws_iam_policy.infrastructure_ecs_cluster_ec2_ecs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy.infrastructure_ecs_cluster_pass_role_ssm_dhmc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy.infrastructure_ecs_cluster_service_codebuild](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | +| [aws_iam_policy.infrastructure_ecs_cluster_service_codebuild_ecr_push](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy.infrastructure_ecs_cluster_service_codebuild_kms_decrypt](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy.infrastructure_ecs_cluster_service_codepipeline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy.infrastructure_ecs_cluster_service_codepipeline_codestar_connection](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | @@ -82,6 +84,7 @@ This project creates and manages resources within an AWS account for infrastruct | [aws_iam_role_policy_attachment.infrastructure_ecs_cluster_ec2_ecs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.infrastructure_ecs_cluster_pass_role_ssm_dhmc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.infrastructure_ecs_cluster_service_codebuild](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.infrastructure_ecs_cluster_service_codebuild_ecr_push](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.infrastructure_ecs_cluster_service_codebuild_kms_decrypt](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.infrastructure_ecs_cluster_service_codepipeline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.infrastructure_ecs_cluster_service_codepipeline_codestar_connection](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | diff --git a/buildspecs/dalmatian-default.yml b/buildspecs/dalmatian-default.yml index dee09ec..ccceb1a 100644 --- a/buildspecs/dalmatian-default.yml +++ b/buildspecs/dalmatian-default.yml @@ -4,17 +4,27 @@ phases: pre_build: commands: - echo Build started on `date` - - echo Entered the pre_build phase... + - echo Logging in to Amazon ECR... + - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com" - echo Updating yarn GPG keys ... - curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add - - echo Building the Docker image... - - docker build -t $CONTAINER_NAME:test . + - docker build -t $IMAGE_REPO_NAME:test . build: commands: - IMAGE_TAG=commit-$CODEBUILD_RESOLVED_SOURCE_VERSION + - echo Tagging the successfully tested image as latest... + - docker tag $IMAGE_REPO_NAME:test $REPOSITORY_URL:latest + - docker tag $IMAGE_REPO_NAME:test $REPOSITORY_URL:$IMAGE_TAG post_build: commands: - echo Build completed on `date` + - echo Pushing the Docker image to ECR ... + - IMAGE_TAG=commit-$CODEBUILD_RESOLVED_SOURCE_VERSION + - docker push $REPOSITORY_URL:latest + - docker push $REPOSITORY_URL:$IMAGE_TAG + - echo "Writing image definitions file..." + - printf '[{"name":"%s","imageUri":"%s"}]' $IMAGE_REPO_NAME $REPOSITORY_URL:$IMAGE_TAG > imagedefinitions.json artifacts: files: - imagedefinitions.json diff --git a/ecs-cluster-infrastructure-service-build-ecr.tf b/ecs-cluster-infrastructure-service-build-ecr.tf new file mode 100644 index 0000000..69c13ea --- /dev/null +++ b/ecs-cluster-infrastructure-service-build-ecr.tf @@ -0,0 +1,14 @@ +resource "aws_ecr_repository" "infrastructure_ecs_cluster_service" { + for_each = local.infrastructure_ecs_cluster_services + + name = "${local.resource_prefix}-${each.key}" + + encryption_configuration { + encryption_type = local.infrastructure_kms_encryption ? "KMS" : "AES256" + kms_key = local.infrastructure_kms_encryption ? aws_kms_key.infrastructure[0].arn : null + } + + image_scanning_configuration { + scan_on_push = true + } +} diff --git a/ecs-cluster-infrastructure-service-build-pipeline-codebuild.tf b/ecs-cluster-infrastructure-service-build-pipeline-codebuild.tf index 4ab059f..0b6c677 100644 --- a/ecs-cluster-infrastructure-service-build-pipeline-codebuild.tf +++ b/ecs-cluster-infrastructure-service-build-pipeline-codebuild.tf @@ -46,6 +46,24 @@ resource "aws_iam_role_policy_attachment" "infrastructure_ecs_cluster_service_co policy_arn = aws_iam_policy.infrastructure_ecs_cluster_service_codebuild_kms_decrypt[each.key].arn } +resource "aws_iam_policy" "infrastructure_ecs_cluster_service_codebuild_ecr_push" { + for_each = local.infrastructure_ecs_cluster_services + + name = "${local.resource_prefix}-${substr(sha512("ecs-service-codepipeline-codebuild-${each.key}-ecr-push"), 0, 6)}" + description = "${local.resource_prefix}-ecs-service-codepipeline-codebuild-${each.key}-ecr-push" + policy = templatefile( + "${path.root}/policies/ecr-push.json.tpl", + { ecr_repository_arn = aws_ecr_repository.infrastructure_ecs_cluster_service[each.key].arn } + ) +} + +resource "aws_iam_role_policy_attachment" "infrastructure_ecs_cluster_service_codebuild_ecr_push" { + for_each = local.infrastructure_ecs_cluster_services + + role = aws_iam_role.infrastructure_ecs_cluster_service_codebuild[each.key].name + policy_arn = aws_iam_policy.infrastructure_ecs_cluster_service_codebuild_ecr_push[each.key].arn +} + resource "aws_codebuild_project" "infrastructure_ecs_cluster_service_build" { for_each = local.infrastructure_ecs_cluster_services @@ -64,8 +82,18 @@ resource "aws_codebuild_project" "infrastructure_ecs_cluster_service_build" { privileged_mode = true environment_variable { - name = "CONTAINER_NAME" - value = "${local.resource_prefix}-${each.key}" + name = "AWS_ACCOUNT_ID" + value = local.aws_account_id + } + + environment_variable { + name = "IMAGE_REPO_NAME" + value = aws_ecr_repository.infrastructure_ecs_cluster_service[each.key].name + } + + environment_variable { + name = "REPOSITORY_URL" + value = aws_ecr_repository.infrastructure_ecs_cluster_service[each.key].repository_url } } diff --git a/policies/ecr-push.json.tpl b/policies/ecr-push.json.tpl new file mode 100644 index 0000000..2f11f40 --- /dev/null +++ b/policies/ecr-push.json.tpl @@ -0,0 +1,23 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Action": [ + "ecr:GetAuthorizationToken" + ], + "Effect": "Allow", + "Resource": "*" + }, + { + "Action": [ + "ecr:BatchCheckLayerAvailability", + "ecr:CompleteLayerUpload", + "ecr:InitiateLayerUpload", + "ecr:PutImage", + "ecr:UploadLayerPart" + ], + "Effect": "Allow", + "Resource": "${ecr_repository_arn}" + } + ] +}