codebuild_cloudformation.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Deploys code pipeline to build aws batch",
  "Metadata": {},
  "Parameters": {
    "codeBuildProjectName": {
      "Description": "The code build project name",
      "Type": "String"
    },
    "gitSourcePublicRepository": {
      "Description": "The github source public repository clone url",
      "Type": "String"
    },
    "buildImage": {
      "Description": "The python build image",
      "Type": "String",
      "Default": "aws/codebuild/python:3.6.5"
    },
    "buildArtifactsS3Bucket": {
      "Description": "The s3 bucket where artifacts will be placed post build",
      "Type": "String"
    },
    "buildArtifactsS3Key": {
      "Description": "The s3 key within the bucket where artifacts will be placed post build",
      "Type": "String"
    },
    "dockerImageRepository": {
      "Description": "The docker image repo to push the image to",
      "Type": "String"
    }
  },
  "Mappings": {},
  "Conditions": {},
  "Resources": {
    "CodeBuild": {
      "Type": "AWS::CodeBuild::Project",
      "Properties": {
        "Artifacts": {
          "Location": {
            "Ref": "buildArtifactsS3Bucket"
          },
          "Name": {
            "Ref": "codeBuildProjectName"
          },
          "Path": {
            "Ref": "buildArtifactsS3Key"
          },
          "Type": "S3"
        },
        "Description": "Builds aws batch docker image",
        "Environment": {
          "Type": "LINUX_CONTAINER",
          "ComputeType": "BUILD_GENERAL1_SMALL",
          "Image": {
            "Ref": "buildImage"
          },
          "PrivilegedMode": "True"
        },
        "Name": {
          "Ref": "codeBuildProjectName"
        },
        "ServiceRole": {
          "Ref": "codeBuildIamRole"
        },
        "Source": {
          "Location": {
            "Ref": "gitSourcePublicRepository"
          },
          "Type": "GITHUB",
          "GitCloneDepth": 1
        },
        "Tags": [
          {
            "Key": "StackName",
            "Value": "AWS::StackName"
          }
        ],
        "TimeoutInMinutes": 20
      }
    },
    "codeBuildIamRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "codebuild.amazonaws.com"
                ]
              },
              "Action": [
                "sts:AssumeRole"
              ]
            }
          ]
        },
        "Policies": [
          {
            "PolicyName": "S3PutArtifactsPolicy",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "s3:PutObject",
                    "s3:ReadObject"
                  ],
                  "Resource": [
                    {
                      "Fn::Join": [
                        "",
                        [
                          "arn:aws:s3:::",
                          {
                            "Ref": "buildArtifactsS3Bucket"
                          },
                          "/",
                          {
                            "Ref": "buildArtifactsS3Key"
                          },
                          "/*"
                        ]
                      ]
                    }
                  ]
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "s3:HeadBucket",
                    "s3:ListBucket"
                  ],
                  "Resource": [
                    {
                      "Fn::Join": [
                        "",
                        [
                          "arn:aws:s3:::",
                          {
                            "Ref": "buildArtifactsS3Bucket"
                          }
                        ]
                      ]
                    }
                  ]
                }
              ]
            }
          },
          {
            "PolicyName": "CloudWatchLogsFullAccess",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Action": [
                    "logs:*"
                  ],
                  "Effect": "Allow",
                  "Resource": "*"
                }
              ]
            }
          },
          {
            "PolicyName": "ECRPutImage",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "ecr:PutImage",
                    "ecr:InitiateLayerUpload",
                    "ecr:UploadLayerPart",
                    "ecr:CompleteLayerUpload",
                    "ecr:BatchCheckLayerAvailability"
                  ],
                  "Resource": [
                    {
                      "Fn::Join": [
                        "",
                        [
                          "arn:aws:ecr:",
                          {
                            "Ref": "AWS::Region"
                          },
                          ":",
                          {
                            "Ref": "AWS::AccountId"
                          },
                          ":repository/",
                          {
                            "Ref": "dockerImageRepository"
                          }
                        ]
                      ]
                    }
                  ]
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "ecr:GetAuthorizationToken"
                  ],
                  "Resource": "*"
                }
              ]
            }
          }
        ],
        "RoleName": {
          "Fn::Join": [
            "",
            [
              {
                "Ref": "AWS::StackName"
              },
              "_CodeBuildIamRole"
            ]
          ]
        }
      }
    }
  },
  "Outputs": {}
}