-
Notifications
You must be signed in to change notification settings - Fork 4k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(codebuild): allow specifying principals and credentials for pull…
…ing build images. When using an image that is hosted in a private Docker registry, you have to pass the appropriate credentials in order to authenticate against that registry. This change allows passing those credentials when creating a custom build image. It also introduces the concept of the principal that CodeBuild will use to pull the image - previously, CodeBuild would always use its own identity when pulling images, which meant using it with an ECR-hosted image required changing the resource policy of the repository to trust CodeBuild's service principal. Now, the default is to use the project's role when doing the pull of the image. Fixes #2175 BREAKING CHANGE: codebuild.LinuxBuildImage.fromDockerHub() has been renamed to fromDockerRegistry() * codebuild.WindowsBuildImage.fromDockerHub() has been renamed to fromDockerRegistry()
- Loading branch information
1 parent
ec1c5b7
commit cad83dc
Showing
10 changed files
with
466 additions
and
143 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
148 changes: 148 additions & 0 deletions
148
packages/@aws-cdk/aws-codebuild/test/integ.docker-registry.lit.expected.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,148 @@ | ||
| { | ||
| "Resources": { | ||
| "MyProjectRole9BBE5233": { | ||
| "Type": "AWS::IAM::Role", | ||
| "Properties": { | ||
| "AssumeRolePolicyDocument": { | ||
| "Statement": [ | ||
| { | ||
| "Action": "sts:AssumeRole", | ||
| "Effect": "Allow", | ||
| "Principal": { | ||
| "Service": { | ||
| "Fn::Join": [ | ||
| "", | ||
| [ | ||
| "codebuild.", | ||
| { | ||
| "Ref": "AWS::URLSuffix" | ||
| } | ||
| ] | ||
| ] | ||
| } | ||
| } | ||
| } | ||
| ], | ||
| "Version": "2012-10-17" | ||
| } | ||
| } | ||
| }, | ||
| "MyProjectRoleDefaultPolicyB19B7C29": { | ||
| "Type": "AWS::IAM::Policy", | ||
| "Properties": { | ||
| "PolicyDocument": { | ||
| "Statement": [ | ||
| { | ||
| "Action": [ | ||
| "logs:CreateLogGroup", | ||
| "logs:CreateLogStream", | ||
| "logs:PutLogEvents" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": [ | ||
| { | ||
| "Fn::Join": [ | ||
| "", | ||
| [ | ||
| "arn:", | ||
| { | ||
| "Ref": "AWS::Partition" | ||
| }, | ||
| ":logs:", | ||
| { | ||
| "Ref": "AWS::Region" | ||
| }, | ||
| ":", | ||
| { | ||
| "Ref": "AWS::AccountId" | ||
| }, | ||
| ":log-group:/aws/codebuild/", | ||
| { | ||
| "Ref": "MyProject39F7B0AE" | ||
| } | ||
| ] | ||
| ] | ||
| }, | ||
| { | ||
| "Fn::Join": [ | ||
| "", | ||
| [ | ||
| "arn:", | ||
| { | ||
| "Ref": "AWS::Partition" | ||
| }, | ||
| ":logs:", | ||
| { | ||
| "Ref": "AWS::Region" | ||
| }, | ||
| ":", | ||
| { | ||
| "Ref": "AWS::AccountId" | ||
| }, | ||
| ":log-group:/aws/codebuild/", | ||
| { | ||
| "Ref": "MyProject39F7B0AE" | ||
| }, | ||
| ":*" | ||
| ] | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "Version": "2012-10-17" | ||
| }, | ||
| "PolicyName": "MyProjectRoleDefaultPolicyB19B7C29", | ||
| "Roles": [ | ||
| { | ||
| "Ref": "MyProjectRole9BBE5233" | ||
| } | ||
| ] | ||
| } | ||
| }, | ||
| "MyProject39F7B0AE": { | ||
| "Type": "AWS::CodeBuild::Project", | ||
| "Properties": { | ||
| "Artifacts": { | ||
| "Type": "NO_ARTIFACTS" | ||
| }, | ||
| "Environment": { | ||
| "ComputeType": "BUILD_GENERAL1_SMALL", | ||
| "Image": "my-registry/my-repo", | ||
| "ImagePullCredentialsType": "SERVICE_ROLE", | ||
| "PrivilegedMode": false, | ||
| "RegistryCredential": { | ||
| "Credential": { | ||
| "Fn::Join": [ | ||
| "", | ||
| [ | ||
| "arn:aws:secretsmanager:", | ||
| { | ||
| "Ref": "AWS::Region" | ||
| }, | ||
| ":", | ||
| { | ||
| "Ref": "AWS::AccountId" | ||
| }, | ||
| ":secret:my-secrets-123456" | ||
| ] | ||
| ] | ||
| }, | ||
| "CredentialProvider": "SECRETS_MANAGER" | ||
| }, | ||
| "Type": "LINUX_CONTAINER" | ||
| }, | ||
| "ServiceRole": { | ||
| "Fn::GetAtt": [ | ||
| "MyProjectRole9BBE5233", | ||
| "Arn" | ||
| ] | ||
| }, | ||
| "Source": { | ||
| "BuildSpec": "{\n \"version\": \"0.2\",\n \"phases\": {\n \"build\": {\n \"commands\": [\n \"ls\"\n ]\n }\n }\n}", | ||
| "Type": "NO_SOURCE" | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } |
36 changes: 36 additions & 0 deletions
36
packages/@aws-cdk/aws-codebuild/test/integ.docker-registry.lit.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| import secretsmanager = require('@aws-cdk/aws-secretsmanager'); | ||
| import cdk = require('@aws-cdk/core'); | ||
| import codebuild = require('../lib'); | ||
|
|
||
| class TestStack extends cdk.Stack { | ||
| constructor(scope: cdk.App, id: string) { | ||
| super(scope, id); | ||
|
|
||
| const secrets = secretsmanager.Secret.fromSecretArn(this, "MySecrets", | ||
| `arn:aws:secretsmanager:${this.region}:${this.account}:secret:my-secrets-123456`); | ||
|
|
||
| new codebuild.Project(this, 'MyProject', { | ||
| buildSpec: codebuild.BuildSpec.fromObject({ | ||
| version: "0.2", | ||
| phases: { | ||
| build: { | ||
| commands: [ 'ls' ] | ||
| } | ||
| } | ||
| }), | ||
| /// !show | ||
| environment: { | ||
| buildImage: codebuild.LinuxBuildImage.fromDockerRegistry('my-registry/my-repo', { | ||
| secretsManagerCredentials: secrets, | ||
| }), | ||
| }, | ||
| /// !hide | ||
| }); | ||
| } | ||
| } | ||
|
|
||
| const app = new cdk.App(); | ||
|
|
||
| new TestStack(app, 'test-codebuild-docker-asset'); | ||
|
|
||
| app.synth(); |
Oops, something went wrong.