Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(pipelines): specifying the Action Role for CodeBuild steps #18293

Merged
merged 6 commits into from May 19, 2022
Merged

fix(pipelines): specifying the Action Role for CodeBuild steps #18293

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
e7b8018
use CodeBuildStep role on the CodeBuildAction
tobytipton Jan 6, 2022
66837bc
fix integ test for newpipeline-with-vpc
tobytipton Jan 6, 2022
1ad504f
change build Action to use its own property for the role
tobytipton Jan 12, 2022
d70c85e
merge from master
tobytipton Apr 5, 2022
19ced3d
rename buildActionRole to actionRole
tobytipton May 18, 2022
a9f937c
Merge branch 'master' into codeBuildStepActionRole
mergify[bot] May 19, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions packages/@aws-cdk/pipelines/lib/codepipeline/_codebuild-factory.ts
View file
Open in desktop
Expand Up @@ -309,6 +309,7 @@ export class CodeBuildFactory implements ICodePipelineActionFactory {
outputs: outputArtifacts,
project,
runOrder: options.runOrder,
role: this.props.role,

// Inclusion of the hash here will lead to the pipeline structure for any changes
// made the config of the underlying CodeBuild Project.
Expand Down
57 changes: 56 additions & 1 deletion packages/@aws-cdk/pipelines/test/codepipeline/codebuild-step.test.ts
View file
Open in desktop
@@ -1,4 +1,5 @@
import { Template, Match } from '@aws-cdk/assertions';
import * as iam from '@aws-cdk/aws-iam';
import { Duration, Stack } from '@aws-cdk/core';
import * as cdkp from '../../lib';
import { PIPELINE_ENV, TestApp, ModernTestGitHubNpmPipeline, AppWithOutput } from '../testhelpers';
Expand Down Expand Up @@ -124,4 +125,58 @@ test('envFromOutputs works even with very long stage and stack names', () => {
});

// THEN - did not throw an error about identifier lengths
});
});

test('role passed it used for project and code build action', () => {
const buildRole = new iam.Role(
pipelineStack,
'BuildRole',
{
roleName: 'BuildRole',
assumedBy: new iam.ServicePrincipal('codebuild.amazon.com'),
},
);
// WHEN
new cdkp.CodePipeline(pipelineStack, 'Pipeline', {
synth: new cdkp.CodeBuildStep('Synth', {
commands: ['/bin/true'],
input: cdkp.CodePipelineSource.gitHub('test/test', 'main'),
role: buildRole,
}),
});

// THEN
Template.fromStack(pipelineStack).hasResourceProperties('AWS::CodeBuild::Project', {
ServiceRole: {
'Fn::GetAtt': [
'BuildRole41B77417',
'Arn',
],
},
});

expect(pipelineStack).toHaveResourceLike('AWS::CodePipeline::Pipeline', {
Stages: [
// source stage
{},
// build stage,
{
Actions: [
{
ActionTypeId: {
Category: 'Build',
Owner: 'AWS',
Provider: 'CodeBuild',
},
RoleArn: {
'Fn::GetAtt': [
'BuildRole41B77417',
'Arn',
],
},
},
],
},
],
});
});
132 changes: 3 additions & 129 deletions packages/@aws-cdk/pipelines/test/integ.newpipeline-with-vpc.expected.json
View file
Open in desktop
Expand Up @@ -684,17 +684,7 @@
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"PipelineAssetsFileAsset1CodePipelineActionRoleC0EC649A",
"Arn"
]
}
},
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"PipelineAssetsFileAsset2CodePipelineActionRole06965A59",
"PipelineAssetsFileRole59943A77",
"Arn"
]
}
Expand Down Expand Up @@ -865,7 +855,7 @@
"Name": "FileAsset1",
"RoleArn": {
"Fn::GetAtt": [
"PipelineAssetsFileAsset1CodePipelineActionRoleC0EC649A",
"PipelineAssetsFileRole59943A77",
"Arn"
]
},
Expand All @@ -891,7 +881,7 @@
"Name": "FileAsset2",
"RoleArn": {
"Fn::GetAtt": [
"PipelineAssetsFileAsset2CodePipelineActionRole06965A59",
"PipelineAssetsFileRole59943A77",
"Arn"
]
},
Expand Down Expand Up @@ -1496,122 +1486,6 @@
]
}
},
"PipelineAssetsFileAsset1CodePipelineActionRoleC0EC649A": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":iam::12345678:root"
]
]
}
}
}
],
"Version": "2012-10-17"
}
}
},
"PipelineAssetsFileAsset1CodePipelineActionRoleDefaultPolicy5F0BE7E8": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"codebuild:BatchGetBuilds",
"codebuild:StartBuild",
"codebuild:StopBuild"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"PipelineAssetsFileAsset185A67CB4",
"Arn"
]
}
}
],
"Version": "2012-10-17"
},
"PolicyName": "PipelineAssetsFileAsset1CodePipelineActionRoleDefaultPolicy5F0BE7E8",
"Roles": [
{
"Ref": "PipelineAssetsFileAsset1CodePipelineActionRoleC0EC649A"
}
]
}
},
"PipelineAssetsFileAsset2CodePipelineActionRole06965A59": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":iam::12345678:root"
]
]
}
}
}
],
"Version": "2012-10-17"
}
}
},
"PipelineAssetsFileAsset2CodePipelineActionRoleDefaultPolicy2399F4BC": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"codebuild:BatchGetBuilds",
"codebuild:StartBuild",
"codebuild:StopBuild"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"PipelineAssetsFileAsset24D2D639B",
"Arn"
]
}
}
],
"Version": "2012-10-17"
},
"PolicyName": "PipelineAssetsFileAsset2CodePipelineActionRoleDefaultPolicy2399F4BC",
"Roles": [
{
"Ref": "PipelineAssetsFileAsset2CodePipelineActionRole06965A59"
}
]
}
},
"PipelineUpdatePipelineSelfMutationRole57E559E8": {
"Type": "AWS::IAM::Role",
"Properties": {
Expand Down