Updated codebuild policy to allow access to cloudfront invalidations

buildspec.yml

version: 0.2
        
phases:
  build:
    commands:
      - set -e
      - docker-compose up -d site
      - docker cp serverless-blazor:/app/ServerlessBlazor/build/wwwroot .
      - docker-compose down
      - aws s3 sync ./wwwroot s3://<YOUR S3 BUCKET NAME>
      - aws cloudfront create-invalidation --distribution-id <YOUR CLOUDFRONT DISTRIBUTION ID> --paths "/*"

codebuildpolicy.yml

  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Join ["",['CodeBuild-', !Ref ProjectName]]
      Path: /service-role/
      Policies:
        - PolicyName: !Join ["",['CodeBuildBasePolicy-', !Ref ProjectName]]
          PolicyDocument:
            Statement:
              - Effect: Allow
                Resource:
                  - !Join ["",["arn:aws:logs:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId", ":log-group:/aws/codebuild/", !Ref ProjectName]]
                  - !Join ["",["arn:aws:logs:", !Ref "AWS::Region", ":", !Ref "AWS::AccountId", ":log-group:/aws/codebuild/", !Ref ProjectName, ":*"]]
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
              - Effect: Allow
                Resource:
                  - !Join ["",["arn:aws:s3:::", !Ref BucketName]]
                  - !Join ["",["arn:aws:s3:::", !Ref BucketName, "/*"]]
                Action:
                  - "s3:PutObject"
                  - "s3:GetBucketAcl"
                  - "s3:GetBucketLocation"
                  - "s3:ListBucket"
              - Effect: Allow
                Resource: "*"
                Action: ["cloudfront:CreateInvalidation"]
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
              - codebuild.amazonaws.com
            Action:
              - 'sts:AssumeRole'

docker-compose.yml

version: "3.8"
services:
  site:
    container_name: serverless-blazor
    build: .
    command: dotnet run /app/ServerlessBlazor

dockerfile

FROM mcr.microsoft.com/dotnet/sdk:5.0 AS build
WORKDIR /app

COPY . .
RUN dotnet restore

WORKDIR /app/ServerlessBlazor/
RUN dotnet publish -c Release -o build