Propagate AWS CodePipeline action roles (#14263)
* Propagate AWS CodePipeline action roles * Add acceptance test for AWS CodePipeline action roles * Isolate AWS CodePipeline service role acceptance test
This commit is contained in:
parent
2011eec0f5
commit
e1c4194dea
|
@ -337,6 +337,10 @@ func expandAwsCodePipelineActions(s []interface{}) []*codepipeline.ActionDeclara
|
|||
action.InputArtifacts = inputArtifacts
|
||||
|
||||
}
|
||||
ra := data["role_arn"].(string)
|
||||
if ra != "" {
|
||||
action.RoleArn = aws.String(ra)
|
||||
}
|
||||
ro := data["run_order"].(int)
|
||||
if ro > 0 {
|
||||
action.RunOrder = aws.Int64(int64(ro))
|
||||
|
@ -374,6 +378,10 @@ func flattenAwsCodePipelineStageActions(actions []*codepipeline.ActionDeclaratio
|
|||
values["input_artifacts"] = flattenAwsCodePipelineActionsInputArtifacts(action.InputArtifacts)
|
||||
}
|
||||
|
||||
if action.RoleArn != nil {
|
||||
values["role_arn"] = *action.RoleArn
|
||||
}
|
||||
|
||||
if action.RunOrder != nil {
|
||||
values["run_order"] = int(*action.RunOrder)
|
||||
}
|
||||
|
|
|
@ -3,6 +3,7 @@ package aws
|
|||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"regexp"
|
||||
"testing"
|
||||
|
||||
"github.com/aws/aws-sdk-go/aws"
|
||||
|
@ -46,6 +47,33 @@ func TestAccAWSCodePipeline_basic(t *testing.T) {
|
|||
})
|
||||
}
|
||||
|
||||
func TestAccAWSCodePipeline_deployWithServiceRole(t *testing.T) {
|
||||
if os.Getenv("GITHUB_TOKEN") == "" {
|
||||
t.Skip("Environment variable GITHUB_TOKEN is not set")
|
||||
}
|
||||
|
||||
name := acctest.RandString(10)
|
||||
|
||||
resource.Test(t, resource.TestCase{
|
||||
PreCheck: func() { testAccPreCheck(t) },
|
||||
Providers: testAccProviders,
|
||||
CheckDestroy: testAccCheckAWSCodePipelineDestroy,
|
||||
Steps: []resource.TestStep{
|
||||
{
|
||||
Config: testAccAWSCodePipelineConfig_deployWithServiceRole(name),
|
||||
Check: resource.ComposeTestCheckFunc(
|
||||
testAccCheckAWSCodePipelineExists("aws_codepipeline.bar"),
|
||||
resource.TestCheckResourceAttr("aws_codepipeline.bar", "stage.2.name", "Deploy"),
|
||||
resource.TestCheckResourceAttr("aws_codepipeline.bar", "stage.2.action.0.category", "Deploy"),
|
||||
resource.TestMatchResourceAttr(
|
||||
"aws_codepipeline.bar", "stage.2.action.0.role_arn",
|
||||
regexp.MustCompile("^arn:aws:iam::[0-9]{12}:role/codepipeline-action-role.*")),
|
||||
),
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
func testAccCheckAWSCodePipelineExists(n string) resource.TestCheckFunc {
|
||||
return func(s *terraform.State) error {
|
||||
rs, ok := s.RootModule().Resources[n]
|
||||
|
@ -314,3 +342,189 @@ resource "aws_codepipeline" "bar" {
|
|||
}
|
||||
`, rName, rName, rName)
|
||||
}
|
||||
|
||||
func testAccAWSCodePipelineConfig_deployWithServiceRole(rName string) string {
|
||||
return fmt.Sprintf(`
|
||||
resource "aws_s3_bucket" "foo" {
|
||||
bucket = "tf-test-pipeline-%s"
|
||||
acl = "private"
|
||||
}
|
||||
|
||||
resource "aws_iam_role" "codepipeline_role" {
|
||||
name = "codepipeline-role-%s"
|
||||
|
||||
assume_role_policy = <<EOF
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"Service": "codepipeline.amazonaws.com"
|
||||
},
|
||||
"Action": "sts:AssumeRole"
|
||||
}
|
||||
]
|
||||
}
|
||||
EOF
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy" "codepipeline_policy" {
|
||||
name = "codepipeline_policy"
|
||||
role = "${aws_iam_role.codepipeline_role.id}"
|
||||
|
||||
policy = <<EOF
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect":"Allow",
|
||||
"Action": [
|
||||
"s3:GetObject",
|
||||
"s3:GetObjectVersion",
|
||||
"s3:GetBucketVersioning"
|
||||
],
|
||||
"Resource": [
|
||||
"${aws_s3_bucket.foo.arn}",
|
||||
"${aws_s3_bucket.foo.arn}/*"
|
||||
]
|
||||
},
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"codebuild:BatchGetBuilds",
|
||||
"codebuild:StartBuild"
|
||||
],
|
||||
"Resource": "*"
|
||||
},
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"sts:AssumeRole"
|
||||
],
|
||||
"Resource": "${aws_iam_role.codepipeline_action_role.arn}"
|
||||
}
|
||||
]
|
||||
}
|
||||
EOF
|
||||
}
|
||||
|
||||
data "aws_caller_identity" "current" {}
|
||||
|
||||
resource "aws_iam_role" "codepipeline_action_role" {
|
||||
name = "codepipeline-action-role-%s"
|
||||
|
||||
assume_role_policy = <<EOF
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"AWS": "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
|
||||
},
|
||||
"Action": "sts:AssumeRole"
|
||||
}
|
||||
]
|
||||
}
|
||||
EOF
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy" "codepipeline_action_policy" {
|
||||
name = "codepipeline_action_policy"
|
||||
role = "${aws_iam_role.codepipeline_action_role.id}"
|
||||
|
||||
policy = <<EOF
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect":"Allow",
|
||||
"Action": [
|
||||
"s3:GetObject",
|
||||
"s3:GetObjectVersion",
|
||||
"s3:GetBucketVersioning"
|
||||
],
|
||||
"Resource": [
|
||||
"${aws_s3_bucket.foo.arn}",
|
||||
"${aws_s3_bucket.foo.arn}/*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
EOF
|
||||
}
|
||||
|
||||
resource "aws_codepipeline" "bar" {
|
||||
name = "test-pipeline-%s"
|
||||
role_arn = "${aws_iam_role.codepipeline_role.arn}"
|
||||
|
||||
artifact_store {
|
||||
location = "${aws_s3_bucket.foo.bucket}"
|
||||
type = "S3"
|
||||
|
||||
encryption_key {
|
||||
id = "4567"
|
||||
type = "KMS"
|
||||
}
|
||||
}
|
||||
|
||||
stage {
|
||||
name = "Source"
|
||||
|
||||
action {
|
||||
name = "Source"
|
||||
category = "Source"
|
||||
owner = "ThirdParty"
|
||||
provider = "GitHub"
|
||||
version = "1"
|
||||
output_artifacts = ["bar"]
|
||||
|
||||
configuration {
|
||||
Owner = "foo-terraform"
|
||||
Repo = "bar"
|
||||
Branch = "stable"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
stage {
|
||||
name = "Build"
|
||||
|
||||
action {
|
||||
name = "Build"
|
||||
category = "Build"
|
||||
owner = "AWS"
|
||||
provider = "CodeBuild"
|
||||
input_artifacts = ["bar"]
|
||||
output_artifacts = ["baz"]
|
||||
version = "1"
|
||||
|
||||
configuration {
|
||||
ProjectName = "foo"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
stage {
|
||||
name = "Deploy"
|
||||
|
||||
action {
|
||||
name = "CreateChangeSet"
|
||||
category = "Deploy"
|
||||
owner = "AWS"
|
||||
provider = "CloudFormation"
|
||||
input_artifacts = ["baz"]
|
||||
role_arn = "${aws_iam_role.codepipeline_action_role.arn}"
|
||||
version = "1"
|
||||
|
||||
configuration {
|
||||
ActionMode = "CHANGE_SET_REPLACE"
|
||||
ChangeSetName = "changeset"
|
||||
StackName = "stack"
|
||||
TemplatePath = "baz::template.yaml"
|
||||
}
|
||||
}
|
||||
}}
|
||||
`, rName, rName, rName, rName)
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue