gmuslia
commented
4 months ago This can be done in the following way by overriding the GlobalResources.CODEBUILD_FACTORY:
.resourceProvider(GlobalResources.CODEBUILD_FACTORY, {
provide(context) {
let proxyConfig;
if (context.has(GlobalResources.PROXY)) {
proxyConfig = context.get(GlobalResources.PROXY)!;
}
const vpc = context.get(GlobalResources.VPC).vpc;
const parameterProvider = context.get(GlobalResources.PARAMETER_STORE);
return new class extends DefaultCodeBuildFactory {
protected generateCodeBuildSecretsManager(props: DefaultCodeBuildFactoryProps) {
const secrets = super.generateCodeBuildSecretsManager(props);
return {
PROXY_USERNAME: secrets.PROXY_USERNAME, // keep only this from SecretsManager
PROXY_PASSWORD: secrets.PROXY_PASSWORD, // keep only this from SecretsManager
};
}
protected generateBuildEnvironmentVariables (props: DefaultCodeBuildFactoryProps) {
let variables = super.generateBuildEnvironmentVariables(props);
return {
...variables,
HTTP_PROXY_PORT: '8080', // overwrite this var as is not available in SecretsManager
HTTPS_PROXY_PORT: '8443', // overwrite this var as is not available in SecretsManager
PROXY_DOMAIN: 'xxxxxxx, // overwrite this var as is not available in SecretsManager
};
}
protected generateRolePolicies (props: DefaultCodeBuildFactoryProps) {
const rolePolicies = super.generateRolePolicies(props);
const newPolicyStatements = [
new cdk.aws_iam.PolicyStatement({
effect: cdk.aws_iam.Effect.ALLOW,
actions: ['codeartifact:GetAuthorizationToken'],
resources: [
'arn:aws:codeartifact:eu-west-1:0123456789012:domain/my-domain',
],
}),
new cdk.aws_iam.PolicyStatement({
actions: [
'codeartifact:DescribePackageVersion',
'codeartifact:DescribeRepository',
'codeartifact:GetPackageVersionReadme',
'codeartifact:GetRepositoryEndpoint',
'codeartifact:ListPackages',
'codeartifact:ListPackageVersions',
'codeartifact:ListPackageVersionAssets',
'codeartifact:ListPackageVersionDependencies',
'codeartifact:ReadFromRepository',
],
resources: [
'arn:aws:codeartifact:eu-west-1:0123456789012:repository/my-domain/my-domain',
],
}),
new cdk.aws_iam.PolicyStatement({
effect: cdk.aws_iam.Effect.ALLOW,
actions: ['sts:GetServiceBearerToken'],
resources: ['*'],
}),
];
return [
...rolePolicies,
...newPolicyStatements,
];
}
}({
resAccount: context.blueprintProps.deploymentDefinition.RES.env.account,
vpc,
proxyConfig,
npmRegistry: context.blueprintProps.npmRegistry,
codeBuildEnvSettings: context.blueprintProps.codeBuildEnvSettings,
parameterProvider,
applicationQualifier: context.blueprintProps.applicationQualifier,
region: context.blueprintProps.deploymentDefinition.RES.env.region,
installCommands: context.get(GlobalResources.PHASE).getCommands(PipelinePhases.INITIALIZE),
});
},
})
.definePhase(PipelinePhases.INITIALIZE, [
PhaseCommands.CONFIGURE_HTTP_PROXY,
PhaseCommands.ENVIRONMENT_PREPARATION,
new ShellScriptPhaseCommand('scripts/codeartifact-login.sh'),
])
ArneOttenVW
Describe the feature
I want to configure the codebuild job to use our private npm registry and for that, i want to use the .npmRegistry functionality on the PipelineBluprintBuilder.
Setting it like this:
Results in the codebuild IAM policy to access the secret:
However, there is no way that I can see to also grant it permission to the KMS key it is encrypted with. If we are supposed to use the kms-key from the encryption stack, that's somewhat of a chicken-and-egg problem right? The encryption-stack key only exists after deployment but the npm secret needs to be encrypted with it before deployment.
Use Case
I would need to edit the codebuild policy manually at the time which would result in frequent overrides whenever there is an update.
Proposed Solution
Add another field to NPMRegistryConfig maybe. Or let us edit the codebuild policy with the PipelineBlueprintBuilder just like we can already add CodeBuild environment variables that way.
Other Information
No response
Acknowledgements
Environment details (OS name and version, etc.)
Ubuntu 22.04