Merge pull request #3662 from ministryofjustice/LAWS-3517

Setting up the local ECR repo for Apex
ministryofjustice · Oct 16, 2023 · b5ae4f9 · b5ae4f9
2 parents ebdc149 + 2111ebe
commit b5ae4f9
Show file tree

Hide file tree

Showing 5 changed files with 147 additions and 0 deletions.
diff --git a/terraform/environments/apex/codebuild.tf b/terraform/environments/apex/codebuild.tf
@@ -0,0 +1,8 @@
+module "apex-ecr-codebuild" {
+  count  = local.environment == "development" ? 1 : 0
+  source = "./modules/codebuild"
+
+  app_name                                     = local.application_name
+  account_id                                   = local.environment_management.account_ids[terraform.workspace]
+  tags                                         = local.tags
+}
diff --git a/terraform/environments/apex/modules/codebuild/codebuild_iam_policy.json.tpl b/terraform/environments/apex/modules/codebuild/codebuild_iam_policy.json.tpl
@@ -0,0 +1,49 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject",
+        "s3:PutObject",
+        "s3:GetObjectVersion",
+        "s3:GetBucketPolicy",
+        "s3:ListBucket"
+      ],
+      "Resource": [
+        "arn:aws:s3:::${s3_report_bucket_name}",
+        "arn:aws:s3:::${s3_report_bucket_name}/*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ],
+      "Action": [
+        "logs:CreateLogGroup",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents",
+        "ecr:GetAuthorizationToken"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Resource": [
+        "arn:aws:ecr:eu-west-2:${core_shared_services_production_account_id}:repository/${app_name}-ecr-repo",
+        "arn:aws:ecr:eu-west-2:${account_id}:repository/${app_name}-local-ecr"
+      ],
+      "Action": [
+        "ecr:GetDownloadUrlForLayer",
+        "ecr:BatchGetImage",
+        "ecr:BatchCheckLayerAvailability",
+        "ecr:PutImage",
+        "ecr:InitiateLayerUpload",
+        "ecr:UploadLayerPart",
+        "ecr:CompleteLayerUpload",
+        "ecr:DescribeRepositories",
+        "ecr:GetAuthorizationToken"
+      ]
+    }
+  ]
+}
diff --git a/terraform/environments/apex/modules/codebuild/codebuild_iam_role.json b/terraform/environments/apex/modules/codebuild/codebuild_iam_role.json
@@ -0,0 +1,12 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "codebuild.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
diff --git a/terraform/environments/apex/modules/codebuild/main.tf b/terraform/environments/apex/modules/codebuild/main.tf
@@ -0,0 +1,64 @@
+######################################################
+# ECR Resources
+######################################################
+
+resource "aws_ecr_repository" "local-ecr" {
+  name                 = "${var.app_name}-local-ecr"
+  image_tag_mutability = "MUTABLE"
+
+  image_scanning_configuration {
+    scan_on_push = false
+  }
+
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.app_name}-local-ecr"
+    },
+  )
+}
+
+resource "aws_ecr_repository_policy" "local-ecr-policy" {
+  repository = aws_ecr_repository.local-ecr.name
+  policy     = data.aws_iam_policy_document.local-ecr-policy-data.json
+}
+
+data "aws_iam_policy_document" "local-ecr-policy-data" {
+  statement {
+    sid    = "AccessECR"
+    effect = "Allow"
+
+    principals {
+      type        = "AWS"
+      identifiers = ["arn:aws:iam::${var.account_id}:role/${var.app_name}-CodeBuildRole", "arn:aws:iam::${var.account_id}:user/cicd-member-user"]
+    }
+
+    actions = [
+      "ecr:GetDownloadUrlForLayer",
+      "ecr:BatchGetImage",
+      "ecr:BatchCheckLayerAvailability",
+      "ecr:PutImage",
+      "ecr:InitiateLayerUpload",
+      "ecr:UploadLayerPart",
+      "ecr:CompleteLayerUpload",
+      "ecr:DescribeRepositories",
+      "ecr:GetRepositoryPolicy",
+      "ecr:ListImages"
+    ]
+  }
+}
+
+######################################################
+# CodeBuild projects
+######################################################
+
+resource "aws_iam_role" "codebuild_s3" {
+  name               = "${var.app_name}-CodeBuildRole"
+  assume_role_policy = file("${path.module}/codebuild_iam_role.json")
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.app_name}-CodeBuildRole"
+    }
+  )
+}
diff --git a/terraform/environments/apex/modules/codebuild/variables.tf b/terraform/environments/apex/modules/codebuild/variables.tf
@@ -0,0 +1,14 @@
+variable "app_name" {
+  type        = string
+  description = "Name of the application"
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Common tags to be used by all resources"
+}
+
+variable "account_id" {
+  type        = string
+  description = "AWS Account ID"
+}