main.tf 3.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132
  1. data "github_repository" "this" {
  2. name = var.name
  3. }
  4. resource "aws_codebuild_project" "this_no_artifact" {
  5. count = var.artifact_s3_bucket == "" ? 1 : 0
  6. name = var.name
  7. description = "Container for ${var.name}"
  8. service_role = var.service_role
  9. encryption_key = var.kms_key
  10. badge_enabled = var.badge_enabled
  11. source {
  12. type = "GITHUB_ENTERPRISE"
  13. location = data.github_repository.this.http_clone_url
  14. report_build_status = true
  15. git_submodules_config {
  16. fetch_submodules = false
  17. }
  18. }
  19. environment {
  20. compute_type = "BUILD_GENERAL1_SMALL"
  21. image = var.codebuild_image
  22. type = "LINUX_CONTAINER"
  23. privileged_mode = true
  24. }
  25. artifacts {
  26. type = "NO_ARTIFACTS"
  27. }
  28. tags = merge(local.standard_tags, var.tags)
  29. # Govcloud incompatible with "project visibility"
  30. # See https://github.com/hashicorp/terraform-provider-aws/issues/22473#issuecomment-1081187035
  31. lifecycle { ignore_changes = [project_visibility] }
  32. }
  33. resource "aws_ecr_repository" "this-server" {
  34. name = "portal_server"
  35. image_tag_mutability = "IMMUTABLE"
  36. image_scanning_configuration {
  37. scan_on_push = true
  38. }
  39. }
  40. resource "aws_ecr_repository" "this-nginx" {
  41. name = "django_nginx"
  42. image_tag_mutability = "IMMUTABLE"
  43. image_scanning_configuration {
  44. scan_on_push = true
  45. }
  46. }
  47. data "aws_iam_policy_document" "ecr_cross_account_policy" {
  48. statement {
  49. sid = "ECRWrite"
  50. effect = "Allow"
  51. actions = [
  52. "ecr:GetAuthorizationToken",
  53. "ecr:GetDownloadUrlForLayer",
  54. "ecr:BatchGetImage",
  55. "ecr:BatchCheckLayerAvailability",
  56. "ecr:PutImage",
  57. "ecr:InitiateLayerUpload",
  58. "ecr:UploadLayerPart",
  59. "ecr:CompleteLayerUpload",
  60. "ecr:DescribeRepositories",
  61. "ecr:ListImages",
  62. "ecr:DescribeImages",
  63. ]
  64. principals {
  65. identifiers = [for a in local.responsible_accounts[var.environment] : "arn:${var.aws_partition}:iam::${a}:root"]
  66. type = "AWS"
  67. }
  68. }
  69. }
  70. resource "aws_ecr_repository_policy" "this-server" {
  71. repository = aws_ecr_repository.this-server.name
  72. policy = data.aws_iam_policy_document.ecr_cross_account_policy.json
  73. }
  74. resource "aws_ecr_lifecycle_policy" "this-server" {
  75. repository = aws_ecr_repository.this-server.name
  76. policy = file("${path.module}/lifecycle-policy.json")
  77. }
  78. resource "aws_ecr_repository_policy" "this-nginx" {
  79. repository = aws_ecr_repository.this-nginx.name
  80. policy = data.aws_iam_policy_document.ecr_cross_account_policy.json
  81. }
  82. resource "aws_ecr_lifecycle_policy" "this-nginx" {
  83. repository = aws_ecr_repository.this-nginx.name
  84. policy = file("${path.module}/lifecycle-policy.json")
  85. }
  86. resource "aws_codebuild_webhook" "this" {
  87. project_name = var.name
  88. filter_group {
  89. filter {
  90. type = "EVENT"
  91. pattern = "PUSH"
  92. }
  93. filter {
  94. type = "HEAD_REF"
  95. pattern = "^refs\\/heads\\/release\\/.*$"
  96. }
  97. }
  98. depends_on = [aws_codebuild_project.this_no_artifact]
  99. }
  100. resource "github_repository_webhook" "this" {
  101. active = true
  102. events = ["push"]
  103. repository = data.github_repository.this.name
  104. configuration {
  105. url = aws_codebuild_webhook.this.payload_url
  106. secret = aws_codebuild_webhook.this.secret
  107. content_type = "json"
  108. insecure_ssl = false
  109. }
  110. }