xdr-terraform-modules/base/codebuild_ecr_base/main.tf

#Base RHEL repository used for building XDR RPMs like syslog-ng in CodeBuild
resource "aws_ecr_repository" "codebuild-rhel7" {
  name  = "codebuild-rhel7"
  tags = merge(var.standard_tags, var.tags)

  image_scanning_configuration {
    scan_on_push = true
  }
}

#Allow codebuild to access the ECR Repository
resource "aws_ecr_repository_policy" "codebuild-rhel7" {
  repository = aws_ecr_repository.codebuild-rhel7.name

  policy = <<EOF
{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "new statement",
            "Effect": "Allow",
            "Principal": {
                "Service": "codebuild.amazonaws.com"
            },
            "Action": [
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability"
            ]
        }
    ]
}
EOF
}

# not needed, but leaving the code for possible future use. 
# #base centos7 image used for building portal
# resource "aws_ecr_repository" "codebuild-centos7" {
#   name     = "codebuild-centos7"
#   tags = merge(var.standard_tags, var.tags)
# }

# #Allow codebuild to access the ECR Repository
# resource "aws_ecr_repository_policy" "codebuild-centos7" {
#   repository = aws_ecr_repository.codebuild-centos7.name

#   policy = <<EOF
# {
#     "Version": "2008-10-17",
#     "Statement": [
#         {
#             "Sid": "new statement",
#             "Effect": "Allow",
#             "Principal": {
#                 "Service": "codebuild.amazonaws.com"
#             },
#             "Action": [
#                 "ecr:GetDownloadUrlForLayer",
#                 "ecr:BatchGetImage",
#                 "ecr:BatchCheckLayerAvailability"
#             ]
#         }
#     ]
# }
# EOF
# }