terraform-aws-codebuild

Terraform module to provision an AWS codebuild CI/CD system.

When to use Codebuild: If you want to stay with AWS, or when you are using ECR, Codepipeline or CodeCommit.

---

It's 100% Open Source and licensed under the APACHE2.

Usage

Include this repository as a module in your existing Terraform code:

module "codebuild" {
  source                 = "jameswoolfenden/codebuild/aws"
  version                = "0.2.70"
  common_tags            = var.common_tags
  description            = var.description
  force_artifact_destroy = var.force_artifact_destroy
  name                   = var.name
  projectroot            = var.projectroot
  sourcecode             = var.sourcecode
}

As always a full example is included for reference.

Testing

Every version of this module is built in Terraform using the the example examplea using Github Actions. It 100% has worked. See the successes and failures here: https://github.com/JamesWoolfenden/terraform-aws-codebuild/actions

Detailed Notes

These templates implement the module terraform-aws-codebuild. It includes a number of defaulted behaviours.

Sample buildspec files

In the root directory there is an example buildspec.yml. This is a build specification you can supply to CodeCommit. It includes some basic codebuild functionality to drive semantic versioning using SSM parameters.

Requirements

No requirements.

Providers

Name	Version
aws	n/a

Modules

No modules.

Resources

Name	Type
aws_cloudwatch_event_rule.codechange	resource
aws_cloudwatch_event_target.triggerbuild	resource
aws_codebuild_project.project	resource
aws_iam_policy.trigger	resource
aws_iam_role.codebuild	resource
aws_iam_role.trigger	resource
aws_iam_role_policy.codebuild	resource
aws_iam_role_policy.codecommit	resource
aws_iam_role_policy_attachment.attachtotriggerrole	resource
aws_s3_bucket.artifacts	resource
aws_s3_bucket_acl.example	resource
aws_s3_bucket_lifecycle_configuration.pike	resource
aws_s3_bucket_public_access_block.artifacts	resource
aws_s3_bucket_server_side_encryption_configuration.example	resource
aws_s3_bucket_versioning.example	resource
aws_ssm_parameter.buildnumber	resource
aws_ssm_parameter.latest	resource
aws_caller_identity.current	data source
aws_iam_policy_document.codebuild	data source
aws_iam_role.existing	data source
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
artifact	Populates the Artifact block	map	{ "namespace_type": "NONE", "packaging": "NONE" }	no
artifact_expiry	number of days	number	365	no
artifact_type	The Artifact type, S3, CODEPIPELINE or NO_ARTIFACT	string	"S3"	no
bucketname	n/a	string	""	no
build_timeout	The time to wait for a CodeBuild to complete before timing out in minutes (default: 5)	string	"60"	no
common_tags	An AWS tagging scheme	map(any)	n/a	yes
defaultbranch	The default git branch	string	"master"	no
description	Yeah it's the description	string	""	no
encryption_disabled	Disable the encryption of artifacts	bool	false	no
environment	A map to describe the build environment and populate the environment block	map(any)	{ "compute_type": "BUILD_GENERAL1_SMALL", "image": "aws/codebuild/nodejs:6.3.1", "privileged_mode": "false", "type": "LINUX_CONTAINER" }	no
force_artifact_destroy	Force the removal of the artifact S3 bucket on destroy (default: false).	string	false	no
kms_key_id	Your Custom KMS key	string	""	no
logs_bucket	The bucket id and path for storing the logs	string	n/a	yes
mfa_delete	Require MFA to delete	string	"Disabled"	no
name	The name of the Build	string	n/a	yes
projectroot	The name of the parent project for SSM	string	"core"	no
reponame	The name of the repository	string	""	no
role	Override for providing a role	string	""	no
sourcecode	A map to describe where your sourcecode comes from, to fill the sourcecode block in a Codebuild project	map(any)	{ "buildspec": "", "location": "", "type": "CODECOMMIT" }	no
sse_algorithm	The type of encryption algorithm to use	string	"aws:kms"	no
versioning	Set bucket to version	string	"Enabled"	no

Outputs

Name	Description
artifact_bucket	n/a
codebuild_role_name	n/a
project	n/a

Policy Requirement

The Terraform resource required is:

resource "aws_iam_policy" "terraform_pike" {
  name_prefix = "terraform_pike"
  path        = "/"
  description = "Pike Autogenerated policy from IAC"

  policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "codebuild:BatchGetProjects",
                "codebuild:CreateProject",
                "codebuild:DeleteProject",
                "codebuild:UpdateProject"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "events:DeleteRule",
                "events:DescribeRule",
                "events:ListTagsForResource",
                "events:ListTargetsByRule",
                "events:PutRule",
                "events:PutTargets",
                "events:RemoveTargets"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": [
                "iam:AttachRolePolicy",
                "iam:CreatePolicy",
                "iam:CreateRole",
                "iam:DeletePolicy",
                "iam:DeleteRole",
                "iam:DeleteRolePolicy",
                "iam:DetachRolePolicy",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:ListAttachedRolePolicies",
                "iam:ListInstanceProfilesForRole",
                "iam:ListPolicyVersions",
                "iam:ListRolePolicies",
                "iam:PassRole",
                "iam:PutRolePolicy",
                "iam:TagRole"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "VisualEditor3",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "VisualEditor4",
            "Effect": "Allow",
            "Action": [
                "s3:CreateBucket",
                "s3:DeleteBucket",
                "s3:GetAccelerateConfiguration",
                "s3:GetBucketAcl",
                "s3:GetBucketCORS",
                "s3:GetBucketLogging",
                "s3:GetBucketObjectLockConfiguration",
                "s3:GetBucketPolicy",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetBucketRequestPayment",
                "s3:GetBucketTagging",
                "s3:GetBucketVersioning",
                "s3:GetBucketWebsite",
                "s3:GetEncryptionConfiguration",
                "s3:GetLifecycleConfiguration",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:GetReplicationConfiguration",
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:PutBucketAcl",
                "s3:PutBucketLogging",
                "s3:PutBucketPublicAccessBlock",
                "s3:PutBucketVersioning",
                "s3:PutEncryptionConfiguration",
                "s3:PutLifecycleConfiguration"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "VisualEditor5",
            "Effect": "Allow",
            "Action": [
                "ssm:AddTagsToResource",
                "ssm:DeleteParameter",
                "ssm:DescribeParameters",
                "ssm:GetParameter",
                "ssm:GetParameters",
                "ssm:ListTagsForResource",
                "ssm:PutParameter"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
})
}

Related Projects

Check out these related projects.

• terraform-aws-codecommit - Storing ones code

Help

Got a question?

File a GitHub issue.

Contributing

Bug Reports & Feature Requests

Please use the issue tracker to report any bugs or file feature requests.

Copyrights

Copyright © 2019-2023 James Woolfenden

License

See LICENSE for full details.

Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Contributors

James Woolfenden