blob: 5b70572d3bf61233a5bf39cc76d5bc2720411245 [file] [log] [blame]
Riku Voipio19fadfa2020-07-02 09:05:50 +03001provider "aws" {
2 region = "us-east-1"
3}
4
5resource "aws_ecr_repository" "trustedfirmware_fvp" {
6 name = "fvp"
7 image_tag_mutability = "MUTABLE"
8}
9
10
11resource "aws_iam_role" "ecr_pushpull_role" {
12 name = "ecr_pushpull_role"
13 description = "Read/Write access to ECR"
14 assume_role_policy = <<EOF
15{
16 "Version": "2012-10-17",
17 "Statement": [
18 {
19 "Effect": "Allow",
20 "Principal": {
21 "AWS": [ "987685672616",
22 "arn:aws:iam::487149096843:user/vault"
23 ]
24 },
25 "Action": "sts:AssumeRole"
26 }
27 ]
28}
29EOF
30}
31
32resource "aws_iam_role_policy" "ecr_pushpull_policy" {
33 name = "ecr_pushpull_policy"
34 role = aws_iam_role.ecr_pushpull_role.id
35
36 policy = <<EOF
37{
38 "Version": "2008-10-17",
39 "Statement": [
40 {
41 "Sid": "AllowPushPull",
42 "Effect": "Allow",
43 "Resource": "*",
44 "Action": [
45 "ecr:GetDownloadUrlForLayer",
46 "ecr:BatchGetImage",
47 "ecr:BatchCheckLayerAvailability",
48 "ecr:GetAuthorizationToken",
49 "ecr:PutImage",
50 "ecr:InitiateLayerUpload",
51 "ecr:UploadLayerPart",
52 "ecr:CompleteLayerUpload"
53 ]
54 }
55 ]
56}
57EOF
58}
59