AWS CodeBuild+custom docker service role example in Terraform

codebuild-policy-example.tf

resource "aws_iam_role" "codebuild_role" {
	name = "codebuild-role"

	assume_role_policy = <<EOF
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"Service": "codebuild.amazonaws.com"
			},
			"Action": "sts:AssumeRole"
		}
	]
}
EOF
}

resource "aws_iam_policy" "codebuild_policy" {
	name = "codebuild-policy"
	path = "/service-role/"
	description = "Policy used in trust relationship with CodeBuild"

	policy = <<POLICY
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Resource": [
				"*"
			],
			"Action": [
				"iam:*",
				"logs:CreateLogGroup",
				"logs:CreateLogStream",
				"logs:PutLogEvents"
			]
		}
	]
}
POLICY
}

resource "aws_iam_policy_attachment" "codebuild" {
	name = "codebuild-policy-attachment"
	policy_arn = "${aws_iam_policy.codebuild_policy.arn}"
	roles = ["${aws_iam_role.codebuild_role.id}"]
}

resource "aws_iam_policy_attachment" "codebuild_poweruser" {
	name = "codebuild-policy-attachment-poweruser"
	policy_arn = "arn:aws:iam::aws:policy/PowerUserAccess"
	roles = [
		"${aws_iam_role.codebuild_role.id}",
		"send_approval-executor",
		"button_handler-executor",
	]
}

codebuild-resource-example.tf

resource "aws_codebuild_project" "vpc-production" {
	name = "VPC-Production"
	description = "Build and launch VPC terraform infrastructure for Production environment"
	build_timeout = "${var.build_timeout}"
	service_role = "${aws_iam_role.codebuild_role.arn}"

	source {
		type = "S3"
		location = "arn:aws:s3:::${aws_s3_bucket.codepipeline-artifacts.id}/VPC-Source"
	}

	artifacts {
		type = "S3"
		name = "VPC-Production"
		location = "${aws_s3_bucket.codepipeline-artifacts.id}"
	}

	environment {
		compute_type = "BUILD_GENERAL1_SMALL"
		image = "${var.ecr_image}"
		type = "LINUX_CONTAINER"

		environment_variable {
			name = "TERRAFORM_ENVIRONMENT"
			value = "production"
		}
	}
}

ecr-policy-document.tf

data "aws_iam_policy_document" "ecr_repository" {
  statement {
    sid    = "AllowOtherAccountsToPullImages"
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["codebuild.amazonaws.com"]
    }

    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability",
    ]
  }
}