main.tf 3.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138
  1. data "github_repository" "this" {
  2. name = var.name
  3. }
  4. resource "aws_codebuild_project" "this_no_artifact" {
  5. count = var.artifact_s3_bucket == "" ? 1 : 0
  6. name = var.name
  7. description = "Container for ${var.name}"
  8. service_role = var.service_role
  9. encryption_key = var.kms_key
  10. badge_enabled = var.badge_enabled
  11. source {
  12. type = "GITHUB_ENTERPRISE"
  13. location = data.github_repository.this.http_clone_url
  14. report_build_status = true
  15. git_submodules_config {
  16. fetch_submodules = false
  17. }
  18. }
  19. environment {
  20. compute_type = "BUILD_GENERAL1_SMALL"
  21. image = var.codebuild_image
  22. type = "LINUX_CONTAINER"
  23. privileged_mode = true
  24. }
  25. artifacts {
  26. type = "NO_ARTIFACTS"
  27. }
  28. tags = merge(local.standard_tags, var.tags)
  29. # Govcloud incompatible with "project visibility"
  30. # See https://github.com/hashicorp/terraform-provider-aws/issues/22473#issuecomment-1081187035
  31. lifecycle { ignore_changes = [project_visibility] }
  32. }
  33. resource "aws_ecr_repository" "this-server" {
  34. name = "portal_server"
  35. # tfsec:ignore:aws-ecr-enforce-immutable-repository Allow mutable tags for now - TO-DO
  36. # image_tag_mutability = "IMMUTABLE"
  37. # MSOCI-2182 - This breaks the push process for new changes to the portal servers.
  38. # The codebuild code depends on being able to tag a new image with the latest tag.
  39. image_scanning_configuration {
  40. scan_on_push = true
  41. }
  42. }
  43. resource "aws_ecr_repository" "this-nginx" {
  44. name = "django_nginx"
  45. # tfsec:ignore:aws-ecr-enforce-immutable-repository Allow mutable tags for now - TO-DO
  46. # image_tag_mutability = "IMMUTABLE"
  47. # MSOCI-2182 - This breaks the push process for new changes to the portal servers.
  48. # The codebuild code depends on being able to tag a new image with the latest tag.
  49. image_scanning_configuration {
  50. scan_on_push = true
  51. }
  52. }
  53. data "aws_iam_policy_document" "ecr_cross_account_policy" {
  54. statement {
  55. sid = "ECRWrite"
  56. effect = "Allow"
  57. actions = [
  58. "ecr:GetAuthorizationToken",
  59. "ecr:GetDownloadUrlForLayer",
  60. "ecr:BatchGetImage",
  61. "ecr:BatchCheckLayerAvailability",
  62. "ecr:PutImage",
  63. "ecr:InitiateLayerUpload",
  64. "ecr:UploadLayerPart",
  65. "ecr:CompleteLayerUpload",
  66. "ecr:DescribeRepositories",
  67. "ecr:ListImages",
  68. "ecr:DescribeImages",
  69. ]
  70. principals {
  71. identifiers = [for a in local.responsible_accounts[var.environment] : "arn:${var.aws_partition}:iam::${a}:root"]
  72. type = "AWS"
  73. }
  74. }
  75. }
  76. resource "aws_ecr_repository_policy" "this-server" {
  77. repository = aws_ecr_repository.this-server.name
  78. policy = data.aws_iam_policy_document.ecr_cross_account_policy.json
  79. }
  80. resource "aws_ecr_lifecycle_policy" "this-server" {
  81. repository = aws_ecr_repository.this-server.name
  82. policy = file("${path.module}/lifecycle-policy.json")
  83. }
  84. resource "aws_ecr_repository_policy" "this-nginx" {
  85. repository = aws_ecr_repository.this-nginx.name
  86. policy = data.aws_iam_policy_document.ecr_cross_account_policy.json
  87. }
  88. resource "aws_ecr_lifecycle_policy" "this-nginx" {
  89. repository = aws_ecr_repository.this-nginx.name
  90. policy = file("${path.module}/lifecycle-policy.json")
  91. }
  92. resource "aws_codebuild_webhook" "this" {
  93. project_name = var.name
  94. filter_group {
  95. filter {
  96. type = "EVENT"
  97. pattern = "PUSH"
  98. }
  99. filter {
  100. type = "HEAD_REF"
  101. pattern = "^refs\\/heads\\/release\\/.*$"
  102. }
  103. }
  104. depends_on = [aws_codebuild_project.this_no_artifact]
  105. }
  106. resource "github_repository_webhook" "this" {
  107. active = true
  108. events = ["push"]
  109. repository = data.github_repository.this.name
  110. configuration {
  111. url = aws_codebuild_webhook.this.payload_url
  112. secret = aws_codebuild_webhook.this.secret
  113. content_type = "json"
  114. insecure_ssl = false
  115. }
  116. }