IAM role added

terraform/environments/apex/modules/codebuild/codebuild_iam_policy.json.tpl

@@ -0,0 +1,49 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject",
+        "s3:PutObject",
+        "s3:GetObjectVersion",
+        "s3:GetBucketPolicy",
+        "s3:ListBucket"
+      ],
+      "Resource": [
+        "arn:aws:s3:::${s3_report_bucket_name}",
+        "arn:aws:s3:::${s3_report_bucket_name}/*"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Resource": [
+        "*"
+      ],
+      "Action": [
+        "logs:CreateLogGroup",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents",
+        "ecr:GetAuthorizationToken"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Resource": [
+        "arn:aws:ecr:eu-west-2:${core_shared_services_production_account_id}:repository/${app_name}-ecr-repo",
+        "arn:aws:ecr:eu-west-2:${account_id}:repository/${app_name}-local-ecr"
+      ],
+      "Action": [
+        "ecr:GetDownloadUrlForLayer",
+        "ecr:BatchGetImage",
+        "ecr:BatchCheckLayerAvailability",
+        "ecr:PutImage",
+        "ecr:InitiateLayerUpload",
+        "ecr:UploadLayerPart",
+        "ecr:CompleteLayerUpload",
+        "ecr:DescribeRepositories",
+        "ecr:GetAuthorizationToken"
+      ]
+    }
+  ]
+}

terraform/environments/apex/modules/codebuild/main.tf

@@ -46,4 +46,19 @@ data "aws_iam_policy_document" "local-ecr-policy-data" {
       "ecr:ListImages"
     ]
   }
+}
+
+######################################################
+# CodeBuild projects
+######################################################
+
+resource "aws_iam_role" "codebuild_s3" {
+  name               = "${var.app_name}-CodeBuildRole"
+  assume_role_policy = file("${path.module}/codebuild_iam_role.json")
+  tags = merge(
+    var.tags,
+    {
+      Name = "${var.app_name}-CodeBuildRole"
+    }
+  )
 }