fix(codebuild): Project lacks permissions for SSM ParameterStore environment variables

packages/@aws-cdk/aws-codebuild/lib/project.ts

@@ -792,6 +792,7 @@ export class Project extends ProjectBase {
     this.projectName = this.getResourceNameAttribute(resource.ref);
 
     this.addToRolePolicy(this.createLoggingPermission());
+    this.addParameterStorePermission(props);
     // add permissions to create and use test report groups
     // with names starting with the project's name,
     // unless the customer explicitly opts out of it
@@ -923,6 +924,30 @@ export class Project extends ProjectBase {
     });
   }
 
+  private addParameterStorePermission(props: ProjectProps) {
+    if (!props.environmentVariables) {
+      return;
+    }
+
+    const resources = Object.values(props.environmentVariables)
+      .filter(envVariable => envVariable.type === BuildEnvironmentVariableType.PARAMETER_STORE)
+      .map(envVariable => Stack.of(this).formatArn({
+        service: 'ssm',
+        resource: 'parameter',
+        sep: ':',
+        resourceName: envVariable.value,
+      }));
+
+    if (resources.length === 0) {
+      return;
+    }
+
+    this.addToRolePolicy(new iam.PolicyStatement({
+      actions: ['ssm:GetParameters'],
+      resources,
+    }));
+  }
+
   private renderEnvironment(
     env: BuildEnvironment = {},
     projectVars: { [name: string]: BuildEnvironmentVariable } = {}): CfnProject.EnvironmentProperty {

packages/@aws-cdk/aws-codebuild/test/test.project.ts

@@ -1,4 +1,4 @@
-import { countResources, expect, haveResource, haveResourceLike, objectLike, not, ResourcePart } from '@aws-cdk/assert';
+import { countResources, expect, haveResource, haveResourceLike, objectLike, not, ResourcePart, arrayWith } from '@aws-cdk/assert';
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as iam from '@aws-cdk/aws-iam';
 import * as logs from '@aws-cdk/aws-logs';
@@ -738,4 +738,156 @@ export = {
       test.done();
     },
   },
+
+  'EnvironmentVariables': {
+    'can use environment variables from parameter store'(test: Test) {
+      // GIVEN
+      const stack = new cdk.Stack();
+
+      // WHEN
+      new codebuild.Project(stack, 'Project', {
+        source: codebuild.Source.s3({
+          bucket: new s3.Bucket(stack, 'Bucket'),
+          path: 'path',
+        }),
+        environment: {
+          buildImage: codebuild.LinuxBuildImage.fromDockerRegistry('myimage'),
+        },
+        environmentVariables: {
+          'ENV_VAR1': {
+            type: codebuild.BuildEnvironmentVariableType.PARAMETER_STORE,
+            value: '/params/param1',
+          },
+        },
+      });
+
+      // THEN
+      expect(stack).to(haveResourceLike('AWS::CodeBuild::Project', {
+        Environment: objectLike({
+          EnvironmentVariables: [{
+            Name: 'ENV_VAR1',
+            Type: 'PARAMETER_STORE',
+            Value: '/params/param1',
+          }],
+        }),
+      }));
+
+      test.done();
+    },
+
+
+    'grant read permission for parameter store variables'(test: Test) {
+      // GIVEN
+      const stack = new cdk.Stack();
+
+      // WHEN
+      new codebuild.Project(stack, 'Project', {
+        source: codebuild.Source.s3({
+          bucket: new s3.Bucket(stack, 'Bucket'),
+          path: 'path',
+        }),
+        environment: {
+          buildImage: codebuild.LinuxBuildImage.fromDockerRegistry('myimage'),
+        },
+        environmentVariables: {
+          'ENV_VAR1': {
+            type: codebuild.BuildEnvironmentVariableType.PARAMETER_STORE,
+            value: '/params/param1',
+          },
+          'ENV_VAR2': {
+            type: codebuild.BuildEnvironmentVariableType.PARAMETER_STORE,
+            value: '/params/param2',
+          },
+        },
+      });
+
+      // THEN
+      expect(stack).to(haveResourceLike('AWS::IAM::Policy', {
+        'PolicyDocument': {
+          'Statement': arrayWith(objectLike({
+            'Action': 'ssm:GetParameters',
+            'Effect': 'Allow',
+            'Resource': [{
+              'Fn::Join': [
+                '',
+                [
+                  'arn:',
+                  {
+                    Ref: 'AWS::Partition',
+                  },
+                  ':ssm:',
+                  {
+                    Ref: 'AWS::Region',
+                  },
+                  ':',
+                  {
+                    Ref: 'AWS::AccountId',
+                  },
+                  ':parameter:/params/param1',
+                ],
+              ],
+            },
+            {
+              'Fn::Join': [
+                '',
+                [
+                  'arn:',
+                  {
+                    Ref: 'AWS::Partition',
+                  },
+                  ':ssm:',
+                  {
+                    Ref: 'AWS::Region',
+                  },
+                  ':',
+                  {
+                    Ref: 'AWS::AccountId',
+                  },
+                  ':parameter:/params/param2',
+                ],
+              ],
+            }],
+          })),
+        },
+      }));
+
+
+      test.done();
+    },
+
+    'should not grant read permission when variables are not from parameter store'(test: Test) {
+
+      // GIVEN
+      const stack = new cdk.Stack();
+
+      // WHEN
+      new codebuild.Project(stack, 'Project', {
+        source: codebuild.Source.s3({
+          bucket: new s3.Bucket(stack, 'Bucket'),
+          path: 'path',
+        }),
+        environment: {
+          buildImage: codebuild.LinuxBuildImage.fromDockerRegistry('myimage'),
+        },
+        environmentVariables: {
+          'ENV_VAR1': {
+            type: codebuild.BuildEnvironmentVariableType.PLAINTEXT,
+            value: 'var1-value',
+          },
+        },
+      });
+
+      // THEN
+      expect(stack).notTo(haveResourceLike('AWS::IAM::Policy', {
+        'PolicyDocument': {
+          'Statement': arrayWith(objectLike({
+            'Action': 'ssm:GetParameters',
+            'Effect': 'Allow',
+          })),
+        },
+      }));
+
+      test.done();
+    },
+  },
 };