-
Notifications
You must be signed in to change notification settings - Fork 618
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Added a minimal ECR image for the signing build environment (#3239)
* added a dockerfile that can build a minimal signing environment image * added a buildspec that tells the codebuild project how to build a minimal signing image * added a stack that builds a minimal image, puts it in ecr and periodically triggers if selected * added an option to provide a custom signer image if necessary * added some details about the minimal build as well as details about the options * had the wrong role in the wrong place ☠️
- Loading branch information
1 parent
90dcc9f
commit cba1b38
Showing
5 changed files
with
329 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| # Pull from Public ECR because less likely to get throttled | ||
| FROM public.ecr.aws/amazonlinux/amazonlinux:2 | ||
|
|
||
| # Assign a build tag because if we ever run into issues with | ||
| # this image, we'll be able to look back at the image tag | ||
| # and figure out what went wrong | ||
| # To build this image, run | ||
| # docker run -t <your_repo>:<tag_you_want> --build-arg builddate=$(date +%Y%m%d) . | ||
| # For reference date +%Y%m%d outputs today's date in YYYYMMDD format | ||
| # We also tag this image with the same tag in ECR | ||
| ARG builddate | ||
| ENV ECS_AGENT_SIGNING_IMAGE_TAG="build-${builddate}" | ||
|
|
||
| RUN yum install -y awscli gpg jq |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,233 @@ | ||
| --- | ||
| AWSTemplateFormatVersion: '2010-09-09' | ||
| Description: A template that creates a minimal signing CodeBuild environment and stores it in ECR | ||
|
|
||
| Parameters: | ||
| SignerImageRepositoryName: | ||
| Type: String | ||
| Description: the name of the ECR repository to upload the signer image to | ||
| Default: ecs-agent-signer | ||
| RepositoryImageRententionPeriodInDays: | ||
| Type: Number | ||
| Default: 180 | ||
| ImageCodeBuildProjectName: | ||
| Type: String | ||
| Description: the name of the CodeBuild project that builds the signing Docker image | ||
| Default: ecs-agent-signer-image-build | ||
| DockerBuildLogsGroupName: | ||
| Type: String | ||
| Description: The name of the log group to store the signing Docker image logs in | ||
| Default: signer-image-build-logs | ||
| CodeStarConnectionArn: | ||
| Type: String | ||
| Description: The ARN of the connection to use to connect to GitHub | ||
| GitHubRepositoryUrl: | ||
| Type: String | ||
| Description: The repository to pull the Dockerfile from so that we can build the signer image | ||
| Default: https://github.com/aws/amazon-ecs-agent | ||
| GitHubBranchName: | ||
| Type: String | ||
| Description: The branch to use from the repository mentioned above | ||
| Default: master | ||
| ImageBuildFrequencyCronExpression: | ||
| Type: String | ||
| Description: A cron expression to periodically build the signing image, can be left blank to disable periodic builds. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html | ||
| Default: 30 10 ? * 4 * | ||
| PeriodicBuildTriggerName: | ||
| Type: String | ||
| Description: The name of the CloudWatch Event rule, ignored if ImageBuildFrequencyCronExpression is blank | ||
| Default: PeriodicallyTriggerSigningImageBuild | ||
| LogGroupRetentionPeriodInDays: | ||
| Type: Number | ||
| Description: The number of days to retain cloudwatch logs | ||
| Default: 180 | ||
| AllowedValues: | ||
| - 1 | ||
| - 3 | ||
| - 5 | ||
| - 7 | ||
| - 14 | ||
| - 30 | ||
| - 60 | ||
| - 90 | ||
| - 120 | ||
| - 150 | ||
| - 180 | ||
| - 365 | ||
| - 400 | ||
| - 545 | ||
| - 731 | ||
| - 1827 | ||
| - 3653 | ||
|
|
||
| Conditions: | ||
| GeneratePeriodicTrigger: | ||
| !Not [!Equals [!Ref 'ImageBuildFrequencyCronExpression', '']] | ||
|
|
||
| Resources: | ||
| DockerBuildLogsGroup: | ||
| Type: AWS::Logs::LogGroup | ||
| Properties: | ||
| LogGroupName: !Ref DockerBuildLogsGroupName | ||
| RetentionInDays: !Ref LogGroupRetentionPeriodInDays | ||
|
|
||
| SignerImageRepository: | ||
| Type: AWS::ECR::Repository | ||
| Properties: | ||
| RepositoryName: !Ref SignerImageRepositoryName | ||
| ImageTagMutability: MUTABLE | ||
| LifecyclePolicy: | ||
| LifecyclePolicyText: !Sub | | ||
| { | ||
| "rules": [ | ||
| { | ||
| "rulePriority": 1, | ||
| "description": "Only keep build-yyyymmdd images for ${RepositoryImageRententionPeriodInDays} days", | ||
| "selection": { | ||
| "countType": "sinceImagePushed", | ||
| "countUnit": "days", | ||
| "countNumber": ${RepositoryImageRententionPeriodInDays}, | ||
| "tagStatus": "tagged", | ||
| "tagPrefixList": [ | ||
| "build" | ||
| ] | ||
| }, | ||
| "action": { | ||
| "type": "expire" | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| ImageCodeBuildProjectServiceRole: | ||
| Type: AWS::IAM::Role | ||
| Properties: | ||
| RoleName: !Sub 'image-codebuild-project-service-role-${AWS::Region}' | ||
| AssumeRolePolicyDocument: | ||
| Version: 2012-10-17 | ||
| Statement: | ||
| Effect: Allow | ||
| Principal: | ||
| Service: codebuild.amazonaws.com | ||
| Action: sts:AssumeRole | ||
| Policies: | ||
| - PolicyName: codebuild-image-build-base-policy | ||
| PolicyDocument: | ||
| Version: 2012-10-17 | ||
| Statement: | ||
| - Sid: EcrPushImageAccess | ||
| Effect: Allow | ||
| Action: | ||
| - ecr:CompleteLayerUpload | ||
| - ecr:UploadLayerPart | ||
| - ecr:InitiateLayerUpload | ||
| - ecr:BatchCheckLayerAvailability | ||
| - ecr:PutImage | ||
| Resource: !GetAtt SignerImageRepository.Arn | ||
| - Sid: EcrGetAuthTokenAccess | ||
| Effect: Allow | ||
| Action: | ||
| - ecr:GetAuthorizationToken | ||
| Resource: '*' | ||
| - Sid: CodeBuildCodeStarConnectionAccess | ||
| Effect: Allow | ||
| Resource: | ||
| - !Ref CodeStarConnectionArn | ||
| Action: | ||
| - codestar-connections:UseConnection | ||
| - Sid: CloudWatchLogsAccess | ||
| Effect: Allow | ||
| Resource: | ||
| - !GetAtt DockerBuildLogsGroup.Arn | ||
| - !Sub '${DockerBuildLogsGroup.Arn}:*' | ||
| Action: | ||
| - logs:CreateLogGroup | ||
| - logs:CreateLogStream | ||
| - logs:PutLogEvents | ||
| - Sid: CodeBuildCreateReportAccess | ||
| Effect: Allow | ||
| Resource: | ||
| - !Sub 'arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:report-group/${ImageCodeBuildProjectName}-*' | ||
| Action: | ||
| - codebuild:CreateReportGroup | ||
| - codebuild:CreateReport | ||
| - codebuild:UpdateReport | ||
| - codebuild:BatchPutTestCases | ||
| - codebuild:BatchPutCodeCoverages | ||
|
|
||
| ImageCodeBuildProject: | ||
| Type: AWS::CodeBuild::Project | ||
| Properties: | ||
| Name: !Ref ImageCodeBuildProjectName | ||
| Description: A CodeBuild project that signs artifacts that were built earlier | ||
| ConcurrentBuildLimit: 10 | ||
| ServiceRole: !GetAtt ImageCodeBuildProjectServiceRole.Arn | ||
| Artifacts: | ||
| Type: NO_ARTIFACTS | ||
| Environment: | ||
| Type: LINUX_CONTAINER | ||
| ComputeType: BUILD_GENERAL1_SMALL | ||
| ImagePullCredentialsType: CODEBUILD | ||
| Image: aws/codebuild/amazonlinux2-x86_64-standard:3.0 | ||
| PrivilegedMode: true | ||
| EnvironmentVariables: | ||
| - Name: SIGNER_ECR_REPO | ||
| Type: PLAINTEXT | ||
| Value: !GetAtt SignerImageRepository.RepositoryUri | ||
| Source: | ||
| BuildSpec: buildspecs/signing-image-build.yml | ||
| Type: GITHUB | ||
| Location: !Ref GitHubRepositoryUrl | ||
| GitSubmodulesConfig: | ||
| FetchSubmodules: true | ||
| SourceVersion: !Ref GitHubBranchName | ||
| TimeoutInMinutes: 60 | ||
| QueuedTimeoutInMinutes: 480 | ||
| LogsConfig: | ||
| CloudWatchLogs: | ||
| GroupName: !Ref DockerBuildLogsGroupName | ||
| Status: ENABLED | ||
| StreamName: !Ref ImageCodeBuildProjectName | ||
|
|
||
| ImageBuildPeriodicTriggerRole: | ||
| Type: AWS::IAM::Role | ||
| Properties: | ||
| RoleName: !Sub 'image-periodic-trigger-service-role-${AWS::Region}' | ||
| AssumeRolePolicyDocument: | ||
| Version: 2012-10-17 | ||
| Statement: | ||
| - Effect: Allow | ||
| Principal: | ||
| Service: events.amazonaws.com | ||
| Action: sts:AssumeRole | ||
| Policies: | ||
| - PolicyName: build-event-trigger-base-policy | ||
| PolicyDocument: | ||
| Version: 2012-10-17 | ||
| Statement: | ||
| - Sid: CodeBuildStartBuildAccess | ||
| Effect: Allow | ||
| Action: | ||
| - codebuild:StartBuild | ||
| Resource: !GetAtt ImageCodeBuildProject.Arn | ||
|
|
||
| PeriodicBuildTrigger: | ||
| Condition: GeneratePeriodicTrigger | ||
| Type: AWS::Events::Rule | ||
| Properties: | ||
| Description: Trigger the image build periodically based on a cron expression | ||
| Name: !Ref PeriodicBuildTriggerName | ||
| RoleArn: !GetAtt ImageBuildPeriodicTriggerRole.Arn | ||
| ScheduleExpression: !Sub 'cron(${ImageBuildFrequencyCronExpression})' | ||
| State: ENABLED | ||
| Targets: | ||
| - Arn: !GetAtt ImageCodeBuildProject.Arn | ||
| Id: !Sub 'codebuild-target-${PeriodicBuildTriggerName}' | ||
| RoleArn: !GetAtt ImageBuildPeriodicTriggerRole.Arn | ||
|
|
||
| Outputs: | ||
| EcrRepositoryUri: | ||
| Description: The URI of the Agent Signer image ECR repository | ||
| Value: !GetAtt SignerImageRepository.RepositoryUri | ||
| Export: | ||
| Name: !Sub '${AWS::StackName}-${AWS::Region}-SignerImageEcrRepositoryUri' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| version: 0.2 | ||
|
|
||
| phases: | ||
| pre_build: | ||
| commands: | ||
| - BUILD_DATE=$(date +%Y%m%d) | ||
| - $(aws --region $AWS_REGION ecr get-login --no-include-email) | ||
| build: | ||
| commands: | ||
| # Go into the right folder | ||
| - cd build-infrastructure | ||
| - echo "Building ecs-agent-signer version $BUILD_DATE" | ||
| # build the image dictated by the Dockerfile.signer file | ||
| - docker build -f Dockerfile.signer -t ecs-agent-signer:latest --build-arg builddate=$BUILD_DATE . | ||
| # Tag the built image with latest as well as the build date | ||
| - echo "Tagging and pushing Docker image to ECR" | ||
| - docker tag ecs-agent-signer:latest $SIGNER_ECR_REPO:latest | ||
| - docker tag ecs-agent-signer:latest $SIGNER_ECR_REPO:build-$BUILD_DATE | ||
| # push the image to ECR | ||
| - docker push $SIGNER_ECR_REPO:latest | ||
| - docker push $SIGNER_ECR_REPO:build-$BUILD_DATE |