Auth MS CodePipeline

codepipeline.authms.tf

resource "aws_iam_role" "cp-iam-role" {
  name = "AWSCodePipelineDeployImage"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "codepipeline.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
}


resource "aws_iam_role_policy" "cp-iam-policy-image" {
  name = "AWSCodePipelineDeployImagePolicy"
  role = aws_iam_role.cp-iam-role.id

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect":"Allow",
      "Action": [
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:GetBucketVersioning",
        "s3:PutObject"
      ],
      "Resource": [
        "${var.s3_artifact_bucket.arn}",
        "${var.s3_artifact_bucket.arn}/*"
      ]
    },
    {
      "Action": [
        "ecr:DescribeImages"
      ],
      "Resource": [ "${aws_ecr_repository.auth-repo}" ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "lambda:InvokeFunction",
        "lambda:ListFunctions",
        "lambda:GetFunction"
      ],
      "Resource": [ "${aws_lambda_function.auth-transform}" ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "ecs:DescribeServices",
        "ecs:DescribeTaskDefinition",
        "ecs:DescribeTasks",
        "ecs:ListTasks",
        "ecs:RegisterTaskDefinition",
        "ecs:UpdateService",
      ],
      "Resource": [ "${aws_ecs_cluster.auth-cluster}", "${aws_ecs_service.auth-service}" ],
      "Effect": "Allow"
    }
  ]
}
EOF
}


resource "aws_codepipeline" "cp-image" {
  name     = var.pipeline_image_name_auth
  role_arn = aws_iam_role.cp-iam-role.arn

  artifact_store {
    location = var.s3_artifact_bucket.bucket
    type     = "S3"
  }

  stage {
    name = "Source-Image"

    action {
      name             = "Source"
      category         = "Source"
      owner            = "AWS"
      provider         = "ECR"
      version          = "1"
      output_artifacts = ["imagedef-image"]

      configuration = {
        ImageTag       = "${var.ecr_tag_auth}"
        RepositoryName = "${var.ecr_auth_ms.name}"
      }
    }
  }

  stage {
    name = "Change-Image-File"

    action {
      name             = "Invoke"
      category         = "Invoke"
      owner            = "AWS"
      provider         = "Lambda"
      version          = "1"
      input_artifacts  = ["imagedef-image"]
      output_artifacts = ["invoke-image"]

      configuration = {
        FunctionName = "${var.lambda_image_change.function_name}"
      }
    }
  }

  stage {
    name = "Deploy"

    action {
      name             = "Deploy"
      category         = "Deploy"
      owner            = "AWS"
      provider         = "ECS"
      input_artifacts  = ["invoke-image"]
      version          = "1"

      configuration = {
        ClusterName   = var.ecs_cluster.name
        ServiceName   = var.ecs_service_auth.name
        FileName      = "tmp/imagedefinitions.json"
      }
    }
  }
}