# Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. # Permission is hereby granted, free of charge, to any person obtaining a copy of this # software and associated documentation files (the "Software"), to deal in the Software # without restriction, including without limitation the rights to use, copy, modify, # merge, publish, distribute, sublicense, and/or sell copies of the Software, and to # permit persons to whom the Software is furnished to do so. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, # INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A # PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT # HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE # SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. AWSTemplateFormatVersion: 2010-09-09 Description: >- This template creates the roles utilized for setting up the Docker Image Builder Pipeline. Parameters: Environment: AllowedValues: - 'dev' - 'sandbox' Type: String Description: 'Set environment in which the VPC will be created' Default: sandbox DemoConfigS3BucketName: Type: String EC2ImageBuilderRoleName: Type: String Default: EC2ImageBuilderRole NetworkStackName: Type: String Description: Stack name which has all of the VPC configuration KMSStackName: Type: String Description: Stack name which has all of the KMS configuration Resources: # S3 Bucket where Nginx Config and Image Builder Config will live S3Bucket: Type: AWS::S3::Bucket Properties: BucketName: !Ref DemoConfigS3BucketName BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: aws:kms KMSMasterKeyID: Fn::ImportValue: !Sub "${KMSStackName}-KeyId" PublicAccessBlockConfiguration: BlockPublicAcls: true IgnorePublicAcls: true BlockPublicPolicy: true RestrictPublicBuckets: true ImageBuilderIamRole: Type: AWS::IAM::Role Properties: RoleName: !Ref EC2ImageBuilderRoleName Description: 'This role will grant EC2 ImageBuilder minimum neccessary permissions to allow pipelines to execute' MaxSessionDuration: 3600 # in seconds Path: / AssumeRolePolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Principal: Service: - ec2.amazonaws.com - ssm.amazonaws.com - imagebuilder.amazonaws.com AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root' Action: - sts:AssumeRole ManagedPolicyArns: - 'arn:aws:iam::aws:policy/EC2InstanceProfileForImageBuilder' - 'arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore' Policies: - PolicyName: GrantS3Read PolicyDocument: Statement: - Sid: GrantS3Read Effect: Allow Action: - s3:List* - s3:Get* - s3:Put* Resource: !Sub 'arn:aws:s3:::${S3Bucket}*' - PolicyName: ListsAndDescribes PolicyDocument: Statement: - Sid: DescribesLists Effect: Allow Resource: '*' Action: - ec2:DescribeImages - codecommit:GitPush - codecommit:GitPull - PolicyName: DecryptKms PolicyDocument: Statement: - Sid: DecryptKms Effect: Allow Action: - kms:Decrypt - kms:Encrypt - kms:GenerateDataKey* - ec2:DescribeImages - ssm:PutParameter Resource: '*' - PolicyName: GrantSsm PolicyDocument: Statement: - Sid: GrantSsm Effect: Allow Action: - ssm:SendCommand Resource: - 'arn:aws:ssm:us-east-1::document/AmazonInspector-ManageAWSAgent' - !Sub 'arn:aws:ec2:us-east-1:${AWS::AccountId}:*/*' - PolicyName: Ec2Tags PolicyDocument: Statement: - Sid: TagOnCreate Effect: Allow Action: - ec2:CreateTags - ec2:RunInstances Resource: !Sub 'arn:aws:ec2:us-east-1:${AWS::AccountId}:*/*' - PolicyName: ImageBuilderPermissions PolicyDocument: Statement: - Sid: ImageBuilderPermissions Effect: Allow Action: - imagebuilder:GetContainerRecipe - ecr:GetAuthorizationToken Resource: '*' - PolicyName: ManageRepositoryContents PolicyDocument: Statement: - Sid: ManageRepositoryContents Effect: Allow Action: - ecr:BatchCheckLayerAvailability - ecr:GetDownloadUrlForLayer - ecr:GetRepositoryPolicy - ecr:DescribeRepositories - ecr:ListImages - ecr:DescribeImages - ecr:BatchGetImage - ecr:InitiateLayerUpload - ecr:UploadLayerPart - ecr:CompleteLayerUpload - ecr:PutImage Resource: !Sub 'arn:aws:ecr:us-east-1:${AWS::AccountId}:*/*' - PolicyName: RegisterContainerInstance PolicyDocument: Statement: - Sid: RegisterContainerInstance Effect: Allow Action: - ecs:RegisterContainerInstance - ecs:CreateCluster - ec2:DescribeTags - ecs:CreateCluster - ecs:DeregisterContainerInstance - ecs:DiscoverPollEndpoint - ecs:Poll - ecs:RegisterContainerInstance - ecs:StartTelemetrySession - ecs:UpdateContainerInstancesState - ecs:Submit* - logs:CreateLogStream - logs:PutLogEvents Resource: - !Sub 'arn:aws:ec2:us-east-1:${AWS::AccountId}:*/*' - !Sub 'arn:aws:ecs:us-east-1:${AWS::AccountId}:*/*' DemoRepo: Type: AWS::CodeCommit::Repository Properties: RepositoryName: DemoRepo RepositoryDescription: 'This is a repository for the docker image builder pipeline.' Outputs: DemoRepo: Value: !GetAtt DemoRepo.Arn Export: Name: !Sub "${AWS::StackName}-Demo-Repo-Name" ImageBuilderRoleArn: Value: !GetAtt ImageBuilderIamRole.Arn Export: Name: !Sub "${AWS::StackName}-Image-Builder-Role-ARN" ImageBuilderRoleName: Value: !Ref ImageBuilderIamRole Export: Name: !Sub "${AWS::StackName}-Image-Builder-Role-Name" S3BucketArn: Description: S3 Bucket ARN Value: !GetAtt S3Bucket.Arn Export: Name: Fn::Sub: "${AWS::StackName}-Bucket-ARN" S3BucketName: Description: S3 Bucket Name Value: !Ref S3Bucket Export: Name: Fn::Sub: "${AWS::StackName}-Bucket-Name"