feat(scheduler-targets): CodeBuild scheduler target

packages/@aws-cdk/aws-scheduler-targets-alpha/lib/codebuild-start-build.ts

@@ -0,0 +1,37 @@
+import { ISchedule, IScheduleTarget } from '@aws-cdk/aws-scheduler-alpha';
+import { Names } from 'aws-cdk-lib';
+import { IProject } from 'aws-cdk-lib/aws-codebuild';
+import { IRole, PolicyStatement } from 'aws-cdk-lib/aws-iam';
+import { ScheduleTargetBase, ScheduleTargetBaseProps } from './target';
+import { sameEnvDimension } from './util';
+
+/**
+ * Use an AWS CodeBuild as a target for AWS EventBridge Scheduler.
+ */
+export class CodeBuildStartBuild extends ScheduleTargetBase implements IScheduleTarget {
+  constructor(
+    private readonly project: IProject,
+    private readonly props: ScheduleTargetBaseProps,
+  ) {
+    super(props, project.projectArn);
+  }
+
+  protected addTargetActionToRole(schedule: ISchedule, role: IRole): void {
+    if (!sameEnvDimension(this.project.env.region, schedule.env.region)) {
+      throw new Error(`Cannot assign function in region ${this.project.env.region} to the schedule ${Names.nodeUniqueId(schedule.node)} in region ${schedule.env.region}. Both the schedule and the function must be in the same region.`);
+    }
+
+    if (!sameEnvDimension(this.project.env.account, schedule.env.account)) {
+      throw new Error(`Cannot assign function in account ${this.project.env.account} to the schedule ${Names.nodeUniqueId(schedule.node)} in account ${schedule.env.region}. Both the schedule and the function must be in the same account.`);
+    }
+
+    if (this.props.role && !sameEnvDimension(this.props.role.env.account, schedule.env.account)) {
+      throw new Error(`Cannot grant permission to execution role in account ${this.props.role.env.account} to invoke target ${Names.nodeUniqueId(schedule.node)} in account ${schedule.env.account}. Both the target and the execution role must be in the same account.`);
+    }
+
+    role.addToPrincipalPolicy(new PolicyStatement({
+      actions: ['codebuild:StartBuild'],
+      resources: [this.project.projectArn],
+    }));
+  }
+}

packages/@aws-cdk/aws-scheduler-targets-alpha/package.json

@@ -114,4 +114,4 @@
       "assert/assert-dependency"
     ]
   }
-}
+}

packages/@aws-cdk/aws-scheduler-targets-alpha/test/codebuild-start-build.test.ts

@@ -0,0 +1,75 @@
+import { Schedule, ScheduleExpression } from '@aws-cdk/aws-scheduler-alpha';
+import { App, Stack } from 'aws-cdk-lib';
+import { Template } from 'aws-cdk-lib/assertions';
+import { BuildSpec, Project } from 'aws-cdk-lib/aws-codebuild';
+import { CodeBuildStartBuild } from '../lib/codebuild-start-build';
+
+describe('codebuild start build', () => {
+  let app: App;
+  let stack: Stack;
+  let codebuildProject: Project;
+  const expr = ScheduleExpression.at(new Date(Date.UTC(1991, 2, 24, 0, 0, 0)));
+
+  beforeEach(() => {
+    app = new App();
+    stack = new Stack(app, 'Stack', { env: { region: 'us-east-1', account: '123456789012' } });
+    codebuildProject = new Project(stack, 'Project', {
+      buildSpec: BuildSpec.fromObject({}),
+    });
+  });
+
+  test('creates IAM role and IAM policy for step function target in the same account', () => {
+    const codeBuildTarget = new CodeBuildStartBuild(codebuildProject, {
+
+    });
+
+    new Schedule(stack, 'MyScheduleDummy', {
+      schedule: expr,
+      target: codeBuildTarget,
+    });
+
+    const template = Template.fromStack(stack);
+    template.hasResource('AWS::Scheduler::Schedule', {
+      Properties: {
+        Target: {
+          Arn: {
+            'Fn::GetAtt': ['ProjectC78D97AD', 'Arn'],
+          },
+          RoleArn: { 'Fn::GetAtt': ['SchedulerRoleForTarget1441a743A31888', 'Arn'] },
+          RetryPolicy: {},
+        },
+      },
+    });
+
+    template.hasResourceProperties('AWS::IAM::Policy', {
+      PolicyDocument: {
+        Statement: [
+          {
+            Action: 'codebuild:StartBuild',
+            Effect: 'Allow',
+            Resource: {
+              'Fn::GetAtt': ['ProjectC78D97AD', 'Arn'],
+            },
+          },
+        ],
+      },
+      Roles: [{ Ref: 'SchedulerRoleForTarget1441a743A31888' }],
+    });
+
+    template.hasResourceProperties('AWS::IAM::Role', {
+      AssumeRolePolicyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Condition: { StringEquals: { 'aws:SourceAccount': '123456789012' } },
+            Principal: {
+              Service: 'scheduler.amazonaws.com',
+            },
+            Action: 'sts:AssumeRole',
+          },
+        ],
+      },
+    });
+  });
+});