xdr-terraform-modules/submodules/codebuild/codebuild-ecr-image/ecr_repo.tf

resource "aws_ecr_repository" "this" {
  name  = var.name
  tags = merge(var.standard_tags, var.tags)

  image_scanning_configuration {
    scan_on_push = true
  }
}

data "aws_iam_policy_document" "ecr_repository_policy" {
  statement {
    sid    = "LetCodebuildServiceUseTheseImages"
    effect = "Allow"
    principals {
      type        = "Service"
      identifiers = [ "codebuild.amazonaws.com" ]
    }
    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability"
    ]
  }

  statement {
    sid    = "LetCodebuildIAMRolePushImagesHere"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = [ var.codebuild_assume_role_arn ]
    }
    actions = [
      "ecr:BatchCheckLayerAvailability",
      "ecr:BatchGetImage",
      "ecr:CompleteLayerUpload",
      "ecr:DescribeImages",
      "ecr:DescribeRepositories",
      "ecr:GetAuthorizationToken",
      "ecr:GetDownloadUrlForLayer",
      "ecr:InitiateLayerUpload",
      "ecr:ListImages",
      "ecr:PutImage",
      "ecr:UploadLayerPart",
    ]
  }

}

#Allow codebuild to access the ECR Repository to use the images
resource "aws_ecr_repository_policy" "this" {
  repository = aws_ecr_repository.this.name
  policy     = data.aws_iam_policy_document.ecr_repository_policy.json
}