xdr-terraform-modules/base/codebuild_splunk_docs/cloudwatch.tf

# creates a role and schedules a build for each server type
# 
# Being polite aws users, we randomize the schedule over the hours of the early morning
resource "random_integer" "hour" {
  min = 5  # Midnight ET
  max = 11 # 6am ET
}

resource "random_integer" "minute" {
  min = 0
  max = 59
}

resource "aws_cloudwatch_event_rule" "schedule_rule" {
  name                = "scheduled_build_docs_${var.repository}"
  schedule_expression = "cron(${random_integer.minute.result} ${random_integer.hour.result} * * ? *)"
}

resource "aws_iam_role" "codebuild_role" {
  name_prefix = "splunk_docs_codebuild_role"
  path        = "/aws_services/"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "events.amazonaws.com",
          "codebuild.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
}

resource "aws_iam_policy" "codebuild_policy" {
  name_prefix = "splunk_docs_policy"
  path        = "/aws_services/"

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Resource": [
                "arn:${var.aws_partition}:logs:${var.aws_region}:${var.aws_account_id}:log-group:/aws/codebuild/*"
            ],
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ]
        },
        {
           "Action": [
              "codebuild:StartBuild",
              "codebuild:StopBuild",
              "codebuild:BatchGet*",
              "codebuild:Get*",
              "codebuild:List*",
              "codecommit:GetBranch",
              "codecommit:GetCommit",
              "codecommit:GetRepository",
              "codecommit:ListBranches"
            ],
            "Effect": "Allow",
            "Resource": "*"
          }
    ]
}
POLICY
}

resource "aws_iam_policy_attachment" "service_role_attachment" {
  name       = "splunk_docs_policy_attachment"
  policy_arn = aws_iam_policy.codebuild_policy.arn
  roles      = [aws_iam_role.codebuild_role.id]
}

resource "aws_cloudwatch_event_target" "trigger_build" {
  target_id = "trigger_build_docs_${var.repository}"
  rule      = aws_cloudwatch_event_rule.schedule_rule.name
  arn       = aws_codebuild_project.this.id

  role_arn = aws_iam_role.codebuild_role.arn
}