codebuild-role.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: "Stack for setting up the NLX CI role."
Parameters:
  KMSKeyArn:
    Type: String
    Default: arn:aws:kms:us-west-2:320464205386:key/ef00015d-739b-456d-a92f-482712af4f32
    Description: The ARN of the kms key protecting secure-strings.
  CDNS3BucketArn:
    Type: String
    Default:  arn:aws:s3:::sso-dashboard.configuration
    Description: The arn of the s3 bucket that you want the lock deployed to.
  CloudFrontDistributionIDArn:
    Type: String
    Description: The arn of the cloudfront distribution for performing cache invalidations.
Resources:
  CodeBuildNLXRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "codebuild.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/iam/nlx/"
      RoleName: codebuild-nlx-ci
  CIParameterStore:
    Type: "AWS::IAM::Policy"
    DependsOn: CodeBuildNLXRole
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Action:
              - "ssm:GetParameter"
              - "ssm:GetParameters"
            Resource: "arn:aws:ssm:*:*:parameter/iam/nlx/*"
          -
            Effect: "Allow"
            Action:
              - "kms:Decrypt"
            Resource: !Ref KMSKeyArn
      PolicyName: get-automated-test-parameters
      Roles:
        -
          Ref: CodeBuildNLXRole
  CIToCloudWatch:
    Type: "AWS::IAM::Policy"
    DependsOn: CodeBuildNLXRole
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Action:
              - "logs:CreateLogGroup"
              - "logs:CreateLogStream"
              - "logs:PutLogEvents"
            Resource: "arn:aws:logs:*:*:log-group:/aws/codebuild/*"
      PolicyName: put-cloudwatch-logs
      Roles:
        -
          Ref: CodeBuildNLXRole
  CIToS3:
    Type: "AWS::IAM::Policy"
    DependsOn: CodeBuildNLXRole
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Action:
              - "s3:*"
            Resource:  !Join [ '', [ !Ref CDNS3BucketArn, '**' ] ]
      PolicyName: put-lock-to-cdn
      Roles:
        -
          Ref: CodeBuildNLXRole
  CIToCloudfront:
    Type: "AWS::IAM::Policy"
    DependsOn: CodeBuildNLXRole
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Action:
              - "cloudfront:CreateInvalidation"
            Resource: '*'
      PolicyName: all-to-cloudfront
      Roles:
        -
          Ref: CodeBuildNLXRole