Skip to content

Commit 81606b6

Browse files
seebeesseebees
authored
chore: Update Release CFN (#343)
#382 Added resources for tests. Add these resources to the release process.
1 parent 8fa4266 commit 81606b6

File tree

4 files changed

+68
-12
lines changed

4 files changed

+68
-12
lines changed

‎cfn/release.yml

Lines changed: 62 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,7 @@ Resources:
167167
"codebuild:BatchPutCodeCoverages"
168168
],
169169
"Resource": [
170-
"arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:report-group/${ProjectName}-Release"
170+
"arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:report-group/${ProjectName}-Release-*"
171171
]
172172
}
173173
]
@@ -214,6 +214,7 @@ Resources:
214214
"arn:aws:kms:*:658956600833:alias/*"
215215
],
216216
"Action": [
217+
"kms:Encrypt",
217218
"kms:Decrypt",
218219
"kms:GenerateDataKey"
219220
]
@@ -254,6 +255,20 @@ Resources:
254255
Action: 'kms:*'
255256
Resource: '*'
256257

258+
S3ECReleaseKMSKeyIDAlternate:
259+
Type: 'AWS::KMS::Key'
260+
Properties:
261+
Description: Alternate KMS Key for Release Testing
262+
Enabled: true
263+
KeyPolicy:
264+
Version: 2012-10-17
265+
Statement:
266+
- Effect: Allow
267+
Principal:
268+
AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
269+
Action: 'kms:*'
270+
Resource: '*'
271+
257272
S3ECReleaseKMSKeyAlias:
258273
Type: 'AWS::KMS::Alias'
259274
Properties:
@@ -263,7 +278,7 @@ Resources:
263278
S3ECReleaseTestS3Bucket:
264279
Type: 'AWS::S3::Bucket'
265280
Properties:
266-
BucketName: s3ec-release-test-bucket
281+
BucketName: !Sub "s3ec-release-test-bucket"
267282
LifecycleConfiguration:
268283
Rules:
269284
- Id: Expire in 14 days
@@ -291,6 +306,29 @@ Resources:
291306
- !Join [ "", [ !GetAtt S3ECReleaseTestS3Bucket.Arn, '/*' ] ]
292307

293308
S3ECReleaseTestKMSKeyPolicy:
309+
Type: 'AWS::IAM::ManagedPolicy'
310+
Properties:
311+
PolicyDocument:
312+
Version: "2012-10-17"
313+
Statement:
314+
- Effect: "Allow"
315+
Resource:
316+
- Sub! "arn:aws:kms:*:${AWS::AccountId}:key/${S3ECReleaseTestingKMSKeyID}"
317+
- Sub! "arn:aws:kms:*:${AWS::AccountId}:${S3ECReleaseKMSKeyAlias}"
318+
Action:
319+
- "kms:Encrypt"
320+
- "kms:Decrypt"
321+
- "kms:GenerateDataKey"
322+
- "kms:GenerateDataKeyPair"
323+
- Effect: Allow
324+
Action: sts:AssumeRole
325+
Resource:
326+
Fn::GetAtt: [ S3ECReleaseTestRoleAlternate, Arn ]
327+
328+
329+
ManagedPolicyName: S3EC-Release-Test-KMS-Key-Policy
330+
331+
S3ECReleaseKMSKeyPolicyAlternate:
294332
Type: 'AWS::IAM::ManagedPolicy'
295333
Properties:
296334
PolicyDocument: !Sub |
@@ -300,16 +338,34 @@ Resources:
300338
{
301339
"Effect": "Allow",
302340
"Resource": [
303-
"arn:aws:kms:*:${AWS::AccountId}:key/${S3ECReleaseTestingKMSKeyID}",
304-
"arn:aws:kms:*:${AWS::AccountId}:${S3ECReleaseKMSKeyAlias}"
341+
"arn:aws:kms:*:${AWS::AccountId}:key/${S3ECReleaseKMSKeyIDAlternate}"
305342
],
306343
"Action": [
307-
"kms:Encrypt",
308344
"kms:Decrypt",
309345
"kms:GenerateDataKey",
310346
"kms:GenerateDataKeyPair"
311347
]
312348
}
313349
]
314350
}
315-
ManagedPolicyName: S3EC-Release-Test-KMS-Key-Policy
351+
ManagedPolicyName: S3EC-Release-KMS-Key-Policy-Alternate
352+
353+
S3ECReleaseTestRoleAlternate:
354+
Type: 'AWS::IAM::Role'
355+
Properties:
356+
Path: /service-role/
357+
RoleName: S3EC-Release-test-role-alternate
358+
AssumeRolePolicyDocument:
359+
Version: "2012-10-17"
360+
Statement:
361+
- Effect: "Allow"
362+
Principal:
363+
Service: codebuild.amazonaws.com
364+
Action:
365+
- "sts:AssumeRole"
366+
Description: >-
367+
Grant S3 put and get and KMS (alt key) encrypt, decrypt, and generate access
368+
for testing
369+
ManagedPolicyArns:
370+
- !Ref S3ECReleaseKMSKeyPolicyAlternate
371+
- !Ref S3ECReleaseS3BucketPolicy

‎codebuild/release/release-prod.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ phases:
2020
pre_build:
2121
commands:
2222
# Test execution environment variables
23-
- export AWS_S3EC_TEST_ALT_KMS_KEY_ARN=arn:aws:kms:us-west-2:${ACCOUNT}:key/ee97fd02-6bb3-4b60-88c1-4ccb18ee978b
24-
- export AWS_S3EC_TEST_ALT_ROLE_ARN=arn:aws:iam::${ACCOUNT}:role/service-role/S3EC-GitHub-test-role-alternate
23+
- export AWS_S3EC_TEST_ALT_KMS_KEY_ARN=arn:aws:kms:us-west-2:${ACCOUNT}:key/94f7843c-ec71-4abd-957c-2fb67c991a37
24+
- export AWS_S3EC_TEST_ALT_ROLE_ARN=arn:aws:iam::${ACCOUNT}:role/service-role/S3EC-Release-test-role-alternate
2525
- export AWS_S3EC_TEST_BUCKET=s3ec-release-test-bucket
2626
- export AWS_S3EC_TEST_KMS_KEY_ID=arn:aws:kms:us-west-2:${ACCOUNT}:key/af4ce40a-05ab-4f7c-b3fa-97bd0c9b7fb1
2727
- export AWS_S3EC_TEST_KMS_KEY_ALIAS=arn:aws:kms:us-west-2:${ACCOUNT}:alias/S3EC-Release-Testing-KMS-Key

‎codebuild/release/release-staging.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@ phases:
2626
- aws secretsmanager get-secret-value --region us-west-2 --secret-id Maven-GPG-Keys-CI --query SecretBinary --output text | base64 -d > ~/mvn_gpg.tgz
2727
- tar -xvf ~/mvn_gpg.tgz -C ~
2828
# Test execution environment variables
29-
- export AWS_S3EC_TEST_ALT_KMS_KEY_ARN=arn:aws:kms:us-west-2:${ACCOUNT}:key/ee97fd02-6bb3-4b60-88c1-4ccb18ee978b
30-
- export AWS_S3EC_TEST_ALT_ROLE_ARN=arn:aws:iam::${ACCOUNT}:role/service-role/S3EC-GitHub-test-role-alternate
29+
- export AWS_S3EC_TEST_ALT_KMS_KEY_ARN=arn:aws:kms:us-west-2:${ACCOUNT}:key/94f7843c-ec71-4abd-957c-2fb67c991a37
30+
- export AWS_S3EC_TEST_ALT_ROLE_ARN=arn:aws:iam::${ACCOUNT}:role/service-role/S3EC-Release-test-role-alternate
3131
- export AWS_S3EC_TEST_BUCKET=s3ec-release-test-bucket
3232
- export AWS_S3EC_TEST_KMS_KEY_ID=arn:aws:kms:us-west-2:${ACCOUNT}:key/af4ce40a-05ab-4f7c-b3fa-97bd0c9b7fb1
3333
- export AWS_S3EC_TEST_KMS_KEY_ALIAS=arn:aws:kms:us-west-2:${ACCOUNT}:alias/S3EC-Release-Testing-KMS-Key

‎codebuild/release/validate-staging.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ phases:
2323
- export CODEARTIFACT_TOKEN=$(aws codeartifact get-authorization-token --domain $DOMAIN --domain-owner $ACCOUNT --query authorizationToken --output text --region ${REGION})
2424
- export CODEARTIFACT_REPO_URL=https://${DOMAIN}-${ACCOUNT}.d.codeartifact.${REGION}.amazonaws.com/maven/${REPOSITORY}
2525
# Test execution environment variables
26-
- export AWS_S3EC_TEST_ALT_KMS_KEY_ARN=arn:aws:kms:us-west-2:${ACCOUNT}:key/ee97fd02-6bb3-4b60-88c1-4ccb18ee978b
27-
- export AWS_S3EC_TEST_ALT_ROLE_ARN=arn:aws:iam::${ACCOUNT}:role/service-role/S3EC-GitHub-test-role-alternate
26+
- export AWS_S3EC_TEST_ALT_KMS_KEY_ARN=arn:aws:kms:us-west-2:${ACCOUNT}:key/94f7843c-ec71-4abd-957c-2fb67c991a37
27+
- export AWS_S3EC_TEST_ALT_ROLE_ARN=arn:aws:iam::${ACCOUNT}:role/service-role/S3EC-Release-test-role-alternate
2828
- export AWS_S3EC_TEST_BUCKET=s3ec-release-test-bucket
2929
- export AWS_S3EC_TEST_KMS_KEY_ID=arn:aws:kms:us-west-2:${ACCOUNT}:key/af4ce40a-05ab-4f7c-b3fa-97bd0c9b7fb1
3030
- export AWS_S3EC_TEST_KMS_KEY_ALIAS=arn:aws:kms:us-west-2:${ACCOUNT}:alias/S3EC-Release-Testing-KMS-Key

0 commit comments

Comments
 (0)