Riku Voipio | 19fadfa | 2020-07-02 09:05:50 +0300 | [diff] [blame] | 1 | provider "aws" { |
| 2 | region = "us-east-1" |
| 3 | } |
| 4 | |
| 5 | resource "aws_ecr_repository" "trustedfirmware_fvp" { |
| 6 | name = "fvp" |
| 7 | image_tag_mutability = "MUTABLE" |
| 8 | } |
| 9 | |
| 10 | |
| 11 | resource "aws_iam_role" "ecr_pushpull_role" { |
| 12 | name = "ecr_pushpull_role" |
| 13 | description = "Read/Write access to ECR" |
| 14 | assume_role_policy = <<EOF |
| 15 | { |
| 16 | "Version": "2012-10-17", |
| 17 | "Statement": [ |
| 18 | { |
| 19 | "Effect": "Allow", |
| 20 | "Principal": { |
| 21 | "AWS": [ "987685672616", |
| 22 | "arn:aws:iam::487149096843:user/vault" |
| 23 | ] |
| 24 | }, |
| 25 | "Action": "sts:AssumeRole" |
| 26 | } |
| 27 | ] |
| 28 | } |
| 29 | EOF |
| 30 | } |
| 31 | |
| 32 | resource "aws_iam_role_policy" "ecr_pushpull_policy" { |
| 33 | name = "ecr_pushpull_policy" |
| 34 | role = aws_iam_role.ecr_pushpull_role.id |
| 35 | |
| 36 | policy = <<EOF |
| 37 | { |
| 38 | "Version": "2008-10-17", |
| 39 | "Statement": [ |
| 40 | { |
| 41 | "Sid": "AllowPushPull", |
| 42 | "Effect": "Allow", |
| 43 | "Resource": "*", |
| 44 | "Action": [ |
| 45 | "ecr:GetDownloadUrlForLayer", |
| 46 | "ecr:BatchGetImage", |
| 47 | "ecr:BatchCheckLayerAvailability", |
| 48 | "ecr:GetAuthorizationToken", |
| 49 | "ecr:PutImage", |
| 50 | "ecr:InitiateLayerUpload", |
| 51 | "ecr:UploadLayerPart", |
| 52 | "ecr:CompleteLayerUpload" |
| 53 | ] |
| 54 | } |
| 55 | ] |
| 56 | } |
| 57 | EOF |
| 58 | } |
| 59 | |