| Riku Voipio | 19fadfa | 2020-07-02 09:05:50 +0300 | [diff] [blame] | 1 | provider "aws" { |
| 2 | region = "us-east-1" |
| 3 | } |
| 4 | |
| Riku Voipio | 09c9ff5 | 2020-07-09 18:00:06 +0300 | [diff] [blame] | 5 | terraform { |
| 6 | backend "remote" { |
| 7 | hostname = "app.terraform.io" |
| 8 | organization = "trustedfirmware" |
| 9 | workspaces { |
| 10 | name = "prod" |
| 11 | } |
| 12 | } |
| 13 | } |
| 14 | |
| Riku Voipio | 19fadfa | 2020-07-02 09:05:50 +0300 | [diff] [blame] | 15 | resource "aws_ecr_repository" "trustedfirmware_fvp" { |
| 16 | name = "fvp" |
| 17 | image_tag_mutability = "MUTABLE" |
| 18 | } |
| 19 | |
| 20 | |
| 21 | resource "aws_iam_role" "ecr_pushpull_role" { |
| 22 | name = "ecr_pushpull_role" |
| 23 | description = "Read/Write access to ECR" |
| 24 | assume_role_policy = <<EOF |
| 25 | { |
| 26 | "Version": "2012-10-17", |
| 27 | "Statement": [ |
| 28 | { |
| 29 | "Effect": "Allow", |
| 30 | "Principal": { |
| 31 | "AWS": [ "987685672616", |
| 32 | "arn:aws:iam::487149096843:user/vault" |
| 33 | ] |
| 34 | }, |
| 35 | "Action": "sts:AssumeRole" |
| 36 | } |
| 37 | ] |
| 38 | } |
| 39 | EOF |
| 40 | } |
| 41 | |
| 42 | resource "aws_iam_role_policy" "ecr_pushpull_policy" { |
| 43 | name = "ecr_pushpull_policy" |
| 44 | role = aws_iam_role.ecr_pushpull_role.id |
| 45 | |
| 46 | policy = <<EOF |
| 47 | { |
| 48 | "Version": "2008-10-17", |
| 49 | "Statement": [ |
| 50 | { |
| 51 | "Sid": "AllowPushPull", |
| 52 | "Effect": "Allow", |
| 53 | "Resource": "*", |
| 54 | "Action": [ |
| 55 | "ecr:GetDownloadUrlForLayer", |
| 56 | "ecr:BatchGetImage", |
| 57 | "ecr:BatchCheckLayerAvailability", |
| 58 | "ecr:GetAuthorizationToken", |
| 59 | "ecr:PutImage", |
| 60 | "ecr:InitiateLayerUpload", |
| 61 | "ecr:UploadLayerPart", |
| 62 | "ecr:CompleteLayerUpload" |
| 63 | ] |
| 64 | } |
| 65 | ] |
| 66 | } |
| 67 | EOF |
| 68 | } |
| 69 | |