Add CPU release repo access

Signed-off-by: kevin <[email protected]>
vllm-project · Dec 18, 2024 · c899dbb · c899dbb
1 parent f62caf9
commit c899dbb
Showing 1 changed file with 49 additions and 1 deletion.
diff --git a/infra/aws/main.tf b/infra/aws/main.tf
@@ -315,7 +315,7 @@ resource "aws_iam_policy" "premerge_ecr_public_write_access_policy" {
         "ecr-public:CompleteLayerUpload",
         "ecr-public:DescribeImageTags",
         "ecr-public:DescribeImages",
-        "ecr-public:DescribeRegistries", 
+        "ecr-public:DescribeRegistries",
         "ecr-public:DescribeRepositories",
         "ecr-public:GetAuthorizationToken",
         "ecr-public:GetRegistryCatalogData",
@@ -330,6 +330,14 @@ resource "aws_iam_policy" "premerge_ecr_public_write_access_policy" {
         "sts:GetServiceBearerToken"
       ]
       Resource = "arn:aws:ecr-public::936637512419:repository/vllm-ci-test-repo"
+    },
+    {
+      Effect   = "Allow"
+      Action = [
+        "ecr-public:GetAuthorizationToken",
+        "sts:GetServiceBearerToken"
+      ],
+      Resource = "*"
     }]
   })
 }
@@ -421,6 +429,38 @@ resource "aws_iam_policy" "release_ecr_public_read_write_access_policy" {
   })
 }
 
+resource "aws_iam_policy" "cpu_release_ecr_public_read_write_access_policy" {
+  name        = "cpu-release-ecr-public-read-write-access-policy"
+  description = "Policy to push and pull images from release ECR"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action = [
+        "ecr-public:BatchCheckLayerAvailability",
+        "ecr-public:CompleteLayerUpload",
+        "ecr-public:DescribeImageTags",
+        "ecr-public:DescribeImages",
+        "ecr-public:DescribeRegistries", 
+        "ecr-public:DescribeRepositories",
+        "ecr-public:GetAuthorizationToken",
+        "ecr-public:GetRegistryCatalogData",
+        "ecr-public:GetRepositoryCatalogData",
+        "ecr-public:GetRepositoryPolicy",
+        "ecr-public:InitiateLayerUpload",
+        "ecr-public:ListTagsForResource",
+        "ecr-public:PutImage",
+        "ecr-public:PutRegistryCatalogData",
+        "ecr-public:TagResource",
+        "ecr-public:UploadLayerPart",
+        "sts:GetServiceBearerToken"
+      ]
+      Resource = "arn:aws:ecr-public::936637512419:repository/vllm-cpu-release-repo"
+    }]
+  })
+}
+
 resource "aws_iam_policy" "bk_stack_secrets_access" {
   name = "access-to-bk-stack-secrets"
 
@@ -535,6 +575,14 @@ resource "aws_iam_role_policy_attachment" "release_ecr_public_read_write_access"
   policy_arn = aws_iam_policy.release_ecr_public_read_write_access_policy.arn
 }
 
+resource "aws_iam_role_policy_attachment" "cpu_release_ecr_public_read_write_access" {
+  for_each   = merge(
+    aws_cloudformation_stack.bk_queue_postmerge
+  )
+  role       = each.value.outputs.InstanceRoleName
+  policy_arn = aws_iam_policy.cpu_release_ecr_public_read_write_access_policy.arn
+}
+
 resource "aws_iam_role_policy_attachment" "bk_stack_secrets_access" {
   for_each = merge(
     aws_cloudformation_stack.bk_queue,