Skip to content

Commit f06ed4b

Browse files
Add IAM policy permissions to allow CodeBuild to run in a VPC (#84)
Co-authored-by: cloudpossebot <[email protected]>
1 parent 3d9d73a commit f06ed4b

13 files changed

+519
-11
lines changed

Diff for: README.md

+21-1
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,27 @@ Available targets:
171171
| aws | >= 2.0 |
172172
| random | >= 2.1 |
173173

174+
## Modules
175+
176+
| Name | Source | Version |
177+
|------|--------|---------|
178+
| this | cloudposse/label/null | 0.24.1 |
179+
180+
## Resources
181+
182+
| Name |
183+
|------|
184+
| [aws_caller_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) |
185+
| [aws_codebuild_project](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_project) |
186+
| [aws_codebuild_source_credential](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_source_credential) |
187+
| [aws_iam_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) |
188+
| [aws_iam_policy_document](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) |
189+
| [aws_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) |
190+
| [aws_iam_role_policy_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) |
191+
| [aws_region](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) |
192+
| [aws_s3_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) |
193+
| [random_string](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) |
194+
174195
## Inputs
175196

176197
| Name | Description | Type | Default | Required |
@@ -239,7 +260,6 @@ Available targets:
239260
| project\_name | Project name |
240261
| role\_arn | IAM Role ARN |
241262
| role\_id | IAM Role ID |
242-
243263
<!-- markdownlint-restore -->
244264

245265

Diff for: docs/terraform.md

+21-1
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,27 @@
1414
| aws | >= 2.0 |
1515
| random | >= 2.1 |
1616

17+
## Modules
18+
19+
| Name | Source | Version |
20+
|------|--------|---------|
21+
| this | cloudposse/label/null | 0.24.1 |
22+
23+
## Resources
24+
25+
| Name |
26+
|------|
27+
| [aws_caller_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) |
28+
| [aws_codebuild_project](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_project) |
29+
| [aws_codebuild_source_credential](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/codebuild_source_credential) |
30+
| [aws_iam_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) |
31+
| [aws_iam_policy_document](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) |
32+
| [aws_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) |
33+
| [aws_iam_role_policy_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) |
34+
| [aws_region](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) |
35+
| [aws_s3_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) |
36+
| [random_string](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) |
37+
1738
## Inputs
1839

1940
| Name | Description | Type | Default | Required |
@@ -82,5 +103,4 @@
82103
| project\_name | Project name |
83104
| role\_arn | IAM Role ARN |
84105
| role\_id | IAM Role ID |
85-
86106
<!-- markdownlint-restore -->

Diff for: examples/complete/fixtures.us-west-1.tfvars renamed to examples/complete/fixtures.us-east-2.tfvars

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
region = "us-west-1"
1+
region = "us-east-2"
22

33
namespace = "eg"
44

55
stage = "test"
66

7-
name = "cedebuild-test"
7+
name = "codebuild-test"
88

99
cache_bucket_suffix_enabled = false
1010

Diff for: examples/vpc/context.tf

+202
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
#
2+
# ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label
3+
# All other instances of this file should be a copy of that one
4+
#
5+
#
6+
# Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf
7+
# and then place it in your Terraform module to automatically get
8+
# Cloud Posse's standard configuration inputs suitable for passing
9+
# to Cloud Posse modules.
10+
#
11+
# Modules should access the whole context as `module.this.context`
12+
# to get the input variables with nulls for defaults,
13+
# for example `context = module.this.context`,
14+
# and access individual variables as `module.this.<var>`,
15+
# with final values filled in.
16+
#
17+
# For example, when using defaults, `module.this.context.delimiter`
18+
# will be null, and `module.this.delimiter` will be `-` (hyphen).
19+
#
20+
21+
module "this" {
22+
source = "cloudposse/label/null"
23+
version = "0.24.1" # requires Terraform >= 0.13.0
24+
25+
enabled = var.enabled
26+
namespace = var.namespace
27+
environment = var.environment
28+
stage = var.stage
29+
name = var.name
30+
delimiter = var.delimiter
31+
attributes = var.attributes
32+
tags = var.tags
33+
additional_tag_map = var.additional_tag_map
34+
label_order = var.label_order
35+
regex_replace_chars = var.regex_replace_chars
36+
id_length_limit = var.id_length_limit
37+
label_key_case = var.label_key_case
38+
label_value_case = var.label_value_case
39+
40+
context = var.context
41+
}
42+
43+
# Copy contents of cloudposse/terraform-null-label/variables.tf here
44+
45+
variable "context" {
46+
type = any
47+
default = {
48+
enabled = true
49+
namespace = null
50+
environment = null
51+
stage = null
52+
name = null
53+
delimiter = null
54+
attributes = []
55+
tags = {}
56+
additional_tag_map = {}
57+
regex_replace_chars = null
58+
label_order = []
59+
id_length_limit = null
60+
label_key_case = null
61+
label_value_case = null
62+
}
63+
description = <<-EOT
64+
Single object for setting entire context at once.
65+
See description of individual variables for details.
66+
Leave string and numeric variables as `null` to use default value.
67+
Individual variable settings (non-null) override settings in context object,
68+
except for attributes, tags, and additional_tag_map, which are merged.
69+
EOT
70+
71+
validation {
72+
condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"])
73+
error_message = "Allowed values: `lower`, `title`, `upper`."
74+
}
75+
76+
validation {
77+
condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"])
78+
error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
79+
}
80+
}
81+
82+
variable "enabled" {
83+
type = bool
84+
default = null
85+
description = "Set to false to prevent the module from creating any resources"
86+
}
87+
88+
variable "namespace" {
89+
type = string
90+
default = null
91+
description = "Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp'"
92+
}
93+
94+
variable "environment" {
95+
type = string
96+
default = null
97+
description = "Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT'"
98+
}
99+
100+
variable "stage" {
101+
type = string
102+
default = null
103+
description = "Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release'"
104+
}
105+
106+
variable "name" {
107+
type = string
108+
default = null
109+
description = "Solution name, e.g. 'app' or 'jenkins'"
110+
}
111+
112+
variable "delimiter" {
113+
type = string
114+
default = null
115+
description = <<-EOT
116+
Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`.
117+
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.
118+
EOT
119+
}
120+
121+
variable "attributes" {
122+
type = list(string)
123+
default = []
124+
description = "Additional attributes (e.g. `1`)"
125+
}
126+
127+
variable "tags" {
128+
type = map(string)
129+
default = {}
130+
description = "Additional tags (e.g. `map('BusinessUnit','XYZ')`"
131+
}
132+
133+
variable "additional_tag_map" {
134+
type = map(string)
135+
default = {}
136+
description = "Additional tags for appending to tags_as_list_of_maps. Not added to `tags`."
137+
}
138+
139+
variable "label_order" {
140+
type = list(string)
141+
default = null
142+
description = <<-EOT
143+
The naming order of the id output and Name tag.
144+
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
145+
You can omit any of the 5 elements, but at least one must be present.
146+
EOT
147+
}
148+
149+
variable "regex_replace_chars" {
150+
type = string
151+
default = null
152+
description = <<-EOT
153+
Regex to replace chars with empty string in `namespace`, `environment`, `stage` and `name`.
154+
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.
155+
EOT
156+
}
157+
158+
variable "id_length_limit" {
159+
type = number
160+
default = null
161+
description = <<-EOT
162+
Limit `id` to this many characters (minimum 6).
163+
Set to `0` for unlimited length.
164+
Set to `null` for default, which is `0`.
165+
Does not affect `id_full`.
166+
EOT
167+
validation {
168+
condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0
169+
error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length."
170+
}
171+
}
172+
173+
variable "label_key_case" {
174+
type = string
175+
default = null
176+
description = <<-EOT
177+
The letter case of label keys (`tag` names) (i.e. `name`, `namespace`, `environment`, `stage`, `attributes`) to use in `tags`.
178+
Possible values: `lower`, `title`, `upper`.
179+
Default value: `title`.
180+
EOT
181+
182+
validation {
183+
condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case)
184+
error_message = "Allowed values: `lower`, `title`, `upper`."
185+
}
186+
}
187+
188+
variable "label_value_case" {
189+
type = string
190+
default = null
191+
description = <<-EOT
192+
The letter case of output label values (also used in `tags` and `id`).
193+
Possible values: `lower`, `title`, `upper` and `none` (no transformation).
194+
Default value: `lower`.
195+
EOT
196+
197+
validation {
198+
condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case)
199+
error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
200+
}
201+
}
202+
#### End of copy of cloudposse/terraform-null-label/variables.tf

Diff for: examples/vpc/fixtures.us-east-2.tfvars

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
region = "us-east-2"
2+
3+
namespace = "eg"
4+
5+
stage = "test"
6+
7+
name = "codebuild-test"
8+
9+
availability_zones = ["us-east-2a", "us-east-2b"]
10+
11+
vpc_cidr_block = "172.16.0.0/16"
12+
13+
cache_bucket_suffix_enabled = false
14+
15+
environment_variables = [
16+
{
17+
name = "APP_URL"
18+
value = "https://app.example.com"
19+
},
20+
{
21+
name = "COMPANY_NAME"
22+
value = "Cloud Posse"
23+
},
24+
{
25+
name = "TIME_ZONE"
26+
value = "America/Los_Angeles"
27+
28+
}
29+
]
30+
31+
cache_expiration_days = 7
32+
33+
cache_type = "S3"

Diff for: examples/vpc/main.tf

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
provider "aws" {
2+
region = var.region
3+
}
4+
5+
module "vpc" {
6+
source = "cloudposse/vpc/aws"
7+
version = "0.21.1"
8+
cidr_block = var.vpc_cidr_block
9+
10+
context = module.this.context
11+
}
12+
13+
module "subnets" {
14+
source = "cloudposse/dynamic-subnets/aws"
15+
version = "0.38.0"
16+
availability_zones = var.availability_zones
17+
vpc_id = module.vpc.vpc_id
18+
igw_id = module.vpc.igw_id
19+
cidr_block = module.vpc.vpc_cidr_block
20+
nat_gateway_enabled = true
21+
nat_instance_enabled = false
22+
23+
context = module.this.context
24+
}
25+
26+
module "codebuild" {
27+
source = "../../"
28+
cache_bucket_suffix_enabled = var.cache_bucket_suffix_enabled
29+
environment_variables = var.environment_variables
30+
cache_expiration_days = var.cache_expiration_days
31+
cache_type = var.cache_type
32+
33+
vpc_config = {
34+
vpc_id = module.vpc.vpc_id
35+
36+
subnets = module.subnets.private_subnet_ids
37+
38+
security_group_ids = [
39+
module.vpc.vpc_default_security_group_id
40+
]
41+
}
42+
43+
context = module.this.context
44+
}

0 commit comments

Comments
 (0)