Add IAM permissions for ECR & SSM access for deploy buildspec

codebase-pipelines/iam.tf

@@ -175,12 +175,23 @@ data "aws_iam_policy_document" "ecr_access_for_codebase_pipeline" {
   statement {
     effect = "Allow"
     actions = [
-      "ecr:DescribeImages"
+      "ecr:DescribeImages",
+      "ecr:BatchGetImage",
+      "ecr:GetDownloadUrlForLayer"
     ]
     resources = [
       aws_ecr_repository.this.arn
     ]
   }
+  statement {
+    effect = "Allow"
+    actions = [
+      "ecr:GetAuthorizationToken"
+    ]
+    resources = [
+      "*"
+    ]
+  }
 }
 
 resource "aws_iam_role_policy" "artifact_store_access_for_codebase_pipeline" {
@@ -274,3 +285,22 @@ data "aws_iam_policy_document" "environment_deploy_role_access" {
     ]
   }
 }
+
+resource "aws_iam_role_policy" "ssm_access" {
+  name   = "ssm-access"
+  role   = aws_iam_role.codebase_deploy.name
+  policy = data.aws_iam_policy_document.ssm_access.json
+}
+
+data "aws_iam_policy_document" "ssm_access" {
+  statement {
+    effect = "Allow"
+    actions = [
+      "ssm:GetParameter",
+      "ssm:GetParameters"
+    ]
+    resources = [
+      "arn:aws:ssm:${local.account_region}:parameter/codebuild/slack_*"
+    ]
+  }
+}