Skip to content

fix(codebuild): correctly handle permissions for Projects inside a VPC#2662

Merged
skinny85 merged 1 commit intoaws:masterfrom
skinny85:fix/codebuild-vpc-permissions
Jun 18, 2019
Merged

fix(codebuild): correctly handle permissions for Projects inside a VPC#2662
skinny85 merged 1 commit intoaws:masterfrom
skinny85:fix/codebuild-vpc-permissions

Conversation

@skinny85
Copy link
Copy Markdown
Contributor

@skinny85 skinny85 commented May 28, 2019

A CodeBuild Project needs to have appropriate EC2 permissions on creation
when it uses a VPC. However, the default Policy that a Project Role has
depends on the Project itself (for CloudWatch Logs permissions).
Because of that, add a dependency between the Policy containing the EC2
permissions and the Project.

Also correctly handle the case when the Project's Role is imported.

Fixes #2651
Fixes #2652

Pull Request Checklist

  • Testing
    • Unit test added (prefer not to modify an existing test, otherwise, it's probably a breaking change)
    • CLI change?: coordinate update of integration tests with team
    • cdk-init template change?: coordinated update of integration tests with team
  • Docs
    • jsdocs: All public APIs documented
    • README: README and/or documentation topic updated
    • Design: For significant features, design document added to design folder
  • Title and Description
    • Change type: title prefixed with fix, feat and module name in parens, which will appear in changelog
    • Title: use lower-case and doesn't end with a period
    • Breaking?: last paragraph: "BREAKING CHANGE: <describe what changed + link for details>"
    • Issues: Indicate issues fixed via: "Fixes #xxx" or "Closes #xxx"
  • Sensitive Modules (requires 2 PR approvers)
    • IAM Policy Document (in @aws-cdk/aws-iam)
    • EC2 Security Groups and ACLs (in @aws-cdk/aws-ec2)
    • Grant APIs (only if not based on official documentation with a reference)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.

@skinny85 skinny85 requested a review from rix0rrr May 28, 2019 21:33
@skinny85 skinny85 requested review from a team and RomainMuller as code owners May 28, 2019 21:33
rix0rrr
rix0rrr reviewed May 29, 2019
View reviewed changes
@rix0rrr
Copy link
Copy Markdown
Contributor

rix0rrr commented May 29, 2019

If we get an imported role to create a policy as usual (if the imported role is in the same account as the deployed stack!), we can also solve this at the same time: #2381

@cjyclaire
Copy link
Copy Markdown

cjyclaire commented Jun 5, 2019 •
edited
Loading

+1 and thanks! :D

rix0rrr added a commit that referenced this pull request Jun 10, 2019
@rix0rrr
fix(iam): support adding permissions to imported roles
a26f7ee 
Now create a Policy and attach it to imported roles as well.

This will only work for imported roles in the same account. If you
need to reference roles in other accounts without trying to add
these policy statements, use an `AwsPrincipal`.

Relates to #2381, #2651, #2652, #2662.
@rix0rrr rix0rrr mentioned this pull request Jun 10, 2019
Merged
4 tasks
@corymhall corymhall mentioned this pull request Jun 12, 2019
Closed
@skinny85
Copy link
Copy Markdown
Contributor Author

skinny85 commented Jun 12, 2019

Waiting for #2805 to land before resuming work on this.

rix0rrr added a commit that referenced this pull request Jun 17, 2019
@rix0rrr
fix(iam): support adding permissions to imported roles (#2805)
936464f 
Now create a Policy and attach it to imported roles as well.

This will only work for imported roles in the same account. If you
need to reference roles in other accounts without trying to add
these policy statements, use an `AwsPrincipal`.

Relates to #2381, #2651, #2652, #2662.
@skinny85 skinny85 force-pushed the fix/codebuild-vpc-permissions branch from 2eef183 to cc7aa81 Compare June 17, 2019 18:34
@skinny85
Copy link
Copy Markdown
Contributor Author

skinny85 commented Jun 17, 2019

#2805 has been merged, so I rebased this PR on top of it. @rix0rrr , please re-review. Thanks!

@skinny85
fix(codebuild): correctly handle permissions for Projects inside VPC.
d2d4b87 
A CodeBuild Project needs to have appropriate EC2 permissions on creation
when it uses a VPC. However, the default Policy that a Project Role has
depends on the Project itself (for CloudWatch Logs permissions).
Because of that, add a dependency between the Policy containing the EC2
permissions and the Project.

BREAKING CHANGE: the method addToRoleInlinePolicy in CodeBuild's Project class has been removed.

Fixes aws#2651
Fixes aws#2652
@skinny85 skinny85 force-pushed the fix/codebuild-vpc-permissions branch from cc7aa81 to d2d4b87 Compare June 18, 2019 18:10
@skinny85
Copy link
Copy Markdown
Contributor Author

skinny85 commented Jun 18, 2019

Rebased to resolve conflicts.

@skinny85 skinny85 mentioned this pull request Jun 18, 2019
Merged
4 tasks
@skinny85 skinny85 merged commit 390baf1 into aws:master Jun 18, 2019
@skinny85 skinny85 deleted the fix/codebuild-vpc-permissions branch June 18, 2019 20:18
@skinny85
Copy link
Copy Markdown
Contributor Author

skinny85 commented Jun 18, 2019

@cjyclaire Merged :)

This was referenced Aug 22, 2019
Open
Open
Open
Open
Open
@NGL321 NGL321 added the contribution/core This is a PR that came from AWS. label Sep 27, 2019
This was referenced Dec 12, 2019
Closed
Closed
Closed
This was referenced Dec 12, 2019
Merged
Closed
Closed
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
This was referenced Jan 20, 2020
Closed
Closed
This was referenced Sep 24, 2024
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
@NOUIY NOUIY mentioned this pull request Oct 2, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rix0rrr rix0rrr rix0rrr approved these changes

@RomainMuller RomainMuller Awaiting requested review from RomainMuller

Assignees

No one assigned

Labels

contribution/core This is a PR that came from AWS.

Projects

None yet

Milestone

No milestone

4 participants

@skinny85 @rix0rrr @cjyclaire @NGL321