ResiLien
/
terraform
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Propagate AWS CodePipeline action roles (#14263) 

* Propagate AWS CodePipeline action roles

* Add acceptance test for AWS CodePipeline action roles

* Isolate AWS CodePipeline service role acceptance test
This commit is contained in:
Christopher Elkins 2017-05-16 01:55:42 -07:00 committed by Paul Stack
parent 2011eec0f5
commit e1c4194dea
2 changed files with 222 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
builtin/providers/aws/resource_aws_codepipeline.go
View File

@ -337,6 +337,10 @@ func expandAwsCodePipelineActions(s []interface{}) []*codepipeline.ActionDeclara
action.InputArtifacts = inputArtifacts
}
ra := data["role_arn"].(string)
if ra != "" {
action.RoleArn = aws.String(ra)
}
ro := data["run_order"].(int)
if ro > 0 {
action.RunOrder = aws.Int64(int64(ro))
@ -374,6 +378,10 @@ func flattenAwsCodePipelineStageActions(actions []*codepipeline.ActionDeclaratio
values["input_artifacts"] = flattenAwsCodePipelineActionsInputArtifacts(action.InputArtifacts)
}
if action.RoleArn != nil {
values["role_arn"] = *action.RoleArn
}
if action.RunOrder != nil {
values["run_order"] = int(*action.RunOrder)
}

214
builtin/providers/aws/resource_aws_codepipeline_test.go
View File

@ -3,6 +3,7 @@ package aws
import (
"fmt"
"os"
"regexp"
"testing"
"github.com/aws/aws-sdk-go/aws"
@ -46,6 +47,33 @@ func TestAccAWSCodePipeline_basic(t *testing.T) {
})
}
func TestAccAWSCodePipeline_deployWithServiceRole(t *testing.T) {
if os.Getenv("GITHUB_TOKEN") == "" {
t.Skip("Environment variable GITHUB_TOKEN is not set")
}
name := acctest.RandString(10)
resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testAccCheckAWSCodePipelineDestroy,
Steps: []resource.TestStep{
{
Config: testAccAWSCodePipelineConfig_deployWithServiceRole(name),
Check: resource.ComposeTestCheckFunc(
testAccCheckAWSCodePipelineExists("aws_codepipeline.bar"),
resource.TestCheckResourceAttr("aws_codepipeline.bar", "stage.2.name", "Deploy"),
resource.TestCheckResourceAttr("aws_codepipeline.bar", "stage.2.action.0.category", "Deploy"),
resource.TestMatchResourceAttr(
"aws_codepipeline.bar", "stage.2.action.0.role_arn",
regexp.MustCompile("^arn:aws:iam::[0-9]{12}:role/codepipeline-action-role.*")),
),
},
},
})
}
func testAccCheckAWSCodePipelineExists(n string) resource.TestCheckFunc {
return func(s *terraform.State) error {
rs, ok := s.RootModule().Resources[n]
@ -314,3 +342,189 @@ resource "aws_codepipeline" "bar" {
}
`, rName, rName, rName)
}
func testAccAWSCodePipelineConfig_deployWithServiceRole(rName string) string {
return fmt.Sprintf(`
resource "aws_s3_bucket" "foo" {
bucket = "tf-test-pipeline-%s"
acl = "private"
}
resource "aws_iam_role" "codepipeline_role" {
name = "codepipeline-role-%s"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "codepipeline.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
}
resource "aws_iam_role_policy" "codepipeline_policy" {
name = "codepipeline_policy"
role = "${aws_iam_role.codepipeline_role.id}"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect":"Allow",
"Action": [
"s3:GetObject",
"s3:GetObjectVersion",
"s3:GetBucketVersioning"
],
"Resource": [
"${aws_s3_bucket.foo.arn}",
"${aws_s3_bucket.foo.arn}/*"
]
},
{
"Effect": "Allow",
"Action": [
"codebuild:BatchGetBuilds",
"codebuild:StartBuild"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"sts:AssumeRole"
],
"Resource": "${aws_iam_role.codepipeline_action_role.arn}"
}
]
}
EOF
}
data "aws_caller_identity" "current" {}
resource "aws_iam_role" "codepipeline_action_role" {
name = "codepipeline-action-role-%s"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
}
resource "aws_iam_role_policy" "codepipeline_action_policy" {
name = "codepipeline_action_policy"
role = "${aws_iam_role.codepipeline_action_role.id}"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect":"Allow",
"Action": [
"s3:GetObject",
"s3:GetObjectVersion",
"s3:GetBucketVersioning"
],
"Resource": [
"${aws_s3_bucket.foo.arn}",
"${aws_s3_bucket.foo.arn}/*"
]
}
]
}
EOF
}
resource "aws_codepipeline" "bar" {
name = "test-pipeline-%s"
role_arn = "${aws_iam_role.codepipeline_role.arn}"
artifact_store {
location = "${aws_s3_bucket.foo.bucket}"
type = "S3"
encryption_key {
id = "4567"
type = "KMS"
}
}
stage {
name = "Source"
action {
name = "Source"
category = "Source"
owner = "ThirdParty"
provider = "GitHub"
version = "1"
output_artifacts = ["bar"]
configuration {
Owner = "foo-terraform"
Repo = "bar"
Branch = "stable"
}
}
}
stage {
name = "Build"
action {
name = "Build"
category = "Build"
owner = "AWS"
provider = "CodeBuild"
input_artifacts = ["bar"]
output_artifacts = ["baz"]
version = "1"
configuration {
ProjectName = "foo"
}
}
}
stage {
name = "Deploy"
action {
name = "CreateChangeSet"
category = "Deploy"
owner = "AWS"
provider = "CloudFormation"
input_artifacts = ["baz"]
role_arn = "${aws_iam_role.codepipeline_action_role.arn}"
version = "1"
configuration {
ActionMode = "CHANGE_SET_REPLACE"
ChangeSetName = "changeset"
StackName = "stack"
TemplatePath = "baz::template.yaml"
}
}
}}
`, rName, rName, rName, rName)
}